@desplega.ai/agent-swarm 1.165.0 → 1.167.0

package/src/hooks/hook.ts

@@ -168,12 +168,25 @@ export async function postHookProfileUpdate({
 }
 
 /**
- * Hook response for blocking actions
+ * Hook JSON responses. Claude Code parses stdout as JSON only when the whole
+ * stdout is one JSON object, so these must be the only stdout of the event.
  * See: https://code.claude.com/docs/en/hooks
  */
-interface HookBlockResponse {
-  decision: "block";
-  reason: string;
+type HookBlockResponse =
+  | {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse";
+        permissionDecision: "deny";
+        permissionDecisionReason: string;
+      };
+    }
+  | { decision: "block"; reason: string };
+
+interface HookContextResponse {
+  hookSpecificOutput: {
+    hookEventName: "PreToolUse" | "PostToolUse";
+    additionalContext: string;
+  };
 }
 
 /**
@@ -850,12 +863,33 @@ export async function handleHook(): Promise<void> {
 
   /**
    * Output a blocking response to stop Claude from continuing.
-   * This is used when a task has been cancelled.
+   * Must be the only stdout of the event: any plain line before it makes
+   * Claude Code read the whole stdout as text and run the tool anyway.
    */
   const outputBlockResponse = (reason: string): void => {
-    const response: HookBlockResponse = {
-      decision: "block",
-      reason,
+    const response: HookBlockResponse =
+      msg.hook_event_name === "PreToolUse"
+        ? {
+            hookSpecificOutput: {
+              hookEventName: "PreToolUse",
+              permissionDecision: "deny",
+              permissionDecisionReason: reason,
+            },
+          }
+        : { decision: "block", reason };
+    console.log(JSON.stringify(response));
+  };
+
+  /**
+   * Output context for the model on a tool event. Plain stdout on PreToolUse
+   * and PostToolUse never reaches the model; additionalContext does.
+   */
+  const outputToolContext = (
+    hookEventName: "PreToolUse" | "PostToolUse",
+    additionalContext: string,
+  ): void => {
+    const response: HookContextResponse = {
+      hookSpecificOutput: { hookEventName, additionalContext },
     };
     console.log(JSON.stringify(response));
   };
@@ -988,8 +1022,23 @@ export async function handleHook(): Promise<void> {
   // Get current agent info
   const agentInfo = await getAgentInfo();
 
-  // Always output agent status with system tray
-  if (agentInfo) {
+  // A block must be the only stdout of the event, so a cancelled task is
+  // checked before the status line goes out.
+  if (
+    msg.hook_event_name === "UserPromptSubmit" &&
+    agentInfo &&
+    !agentInfo.isLead &&
+    agentInfo.status === "busy"
+  ) {
+    if (await checkAndBlockIfCancelled(true)) {
+      return;
+    }
+  }
+
+  // Output agent status with system tray. Skipped on tool events: their plain
+  // stdout never reaches the model and would break a JSON decision.
+  const isToolEvent = msg.hook_event_name === "PreToolUse" || msg.hook_event_name === "PostToolUse";
+  if (agentInfo && !isToolEvent) {
     // Base status line
     console.log(
       `You are registered as ${agentInfo.isLead ? "lead" : "worker"} agent "${agentInfo.name}" (ID: ${agentInfo.id}, status: ${agentInfo.status}).`,
@@ -1004,7 +1053,7 @@ export async function handleHook(): Promise<void> {
     }
   } else if (
     shouldShowRegistrationNudge({
-      agentInfoPresent: false,
+      agentInfoPresent: Boolean(agentInfo),
       eventType: msg.hook_event_name,
       hasAgentIdHeader: hasAgentIdHeader(),
     })
@@ -1131,8 +1180,7 @@ export async function handleHook(): Promise<void> {
       }
 
       // Block `gh pr create|edit` when the body for a public repo leaks internal
-      // identifiers. Exit code 2 blocks the call even though the status line
-      // above already went to stdout, and stderr reaches the model.
+      // identifiers. Exit code 2 blocks the call and stderr reaches the model.
       if (msg.tool_name === "Bash") {
         const prBodyBlock = await guardGhPrBody(msg.tool_input, msg.cwd ?? process.cwd());
         if (prBodyBlock) {
@@ -1142,6 +1190,9 @@ export async function handleHook(): Promise<void> {
         }
       }
 
+      // Emitted last, so a later block stays the only stdout of the event.
+      let loopWarning: string | undefined;
+
       // Tool loop detection (workers only, when processing a task)
       if (agentInfo && !agentInfo.isLead && agentInfo.status === "busy") {
         const loopTaskFile = await readTaskFile();
@@ -1162,7 +1213,7 @@ export async function handleHook(): Promise<void> {
           }
 
           if (loopResult.severity === "warning" && loopResult.reason) {
-            console.log(`Warning: ${loopResult.reason}`);
+            loopWarning = `Warning: ${loopResult.reason}`;
           }
         }
       }
@@ -1179,6 +1230,9 @@ export async function handleHook(): Promise<void> {
         }
       }
 
+      if (loopWarning) {
+        outputToolContext("PreToolUse", loopWarning);
+      }
       break;
     }
 
@@ -1200,7 +1254,8 @@ export async function handleHook(): Promise<void> {
           method: "PUT",
           headers: mcpConfig!.headers,
         }).catch((e) => {
-          console.debug("Failed to update agent activity timestamp:", e);
+          // stderr: stdout on this event is reserved for one JSON object.
+          console.error("Failed to update agent activity timestamp:", e);
         });
       }
 
@@ -1270,7 +1325,8 @@ export async function handleHook(): Promise<void> {
           if (msg.tool_name?.endsWith("send-task")) {
             const maybeTaskId = (msg.tool_response as { task?: { id?: string } })?.task?.id;
 
-            console.log(
+            outputToolContext(
+              "PostToolUse",
               `Task sent successfully.${maybeTaskId ? ` Task ID: ${maybeTaskId}.` : ""} Monitor progress using the get-task-details tool periodically.`,
             );
           }
@@ -1278,17 +1334,6 @@ export async function handleHook(): Promise<void> {
       }
       break;
 
-    case "UserPromptSubmit": {
-      // For worker agents, check if their task has been cancelled
-      // This catches cancellations at the start of a new iteration
-      if (agentInfo && !agentInfo.isLead && agentInfo.status === "busy") {
-        if (await checkAndBlockIfCancelled(true)) {
-          return; // Exit early
-        }
-      }
-      break;
-    }
-
     case "Stop":
       // Clean up any artifact tunnels managed by PM2
       try {

package/src/http/codex-oauth-device.ts

@@ -1,7 +1,8 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
 import { decryptSecret, encryptSecret, getEncryptionKey } from "../be/crypto";
-import { getDbClient, getKv, upsertKv, upsertSwarmConfig } from "../be/db";
+import { getDbClient, upsertSwarmConfig } from "../be/db";
+import { getCodexDeviceFlow, upsertCodexDeviceFlow } from "../be/db/codex-oauth-device-flows";
 import { updateOnboardingAiFromCodexDevice } from "../be/onboarding";
 import {
   CODEX_DEVICE_VERIFICATION_URL,
@@ -17,7 +18,6 @@ import { ensureConfigAdmin } from "./config";
 import { route } from "./route-def";
 import { jsonError } from "./utils";
 
-const FLOW_NAMESPACE = "codex-oauth-device";
 const FLOW_TTL_MS = 15 * 60 * 1_000;
 const POLL_LEASE_MS = 45_000;
 
@@ -85,10 +85,10 @@ function registerFlowSecrets(state: FlowState): void {
 }
 
 async function readFlow(flowId: string): Promise<FlowState | null> {
-  const entry = await getKv(FLOW_NAMESPACE, flowId);
-  if (!entry || typeof entry.value !== "string") return null;
+  const entry = await getCodexDeviceFlow(flowId);
+  if (!entry) return null;
   try {
-    const plaintext = decryptSecret(entry.value, getEncryptionKey());
+    const plaintext = decryptSecret(entry.state, getEncryptionKey());
     const parsed = FlowStateSchema.safeParse(JSON.parse(plaintext));
     if (!parsed.success) return null;
     registerFlowSecrets(parsed.data);
@@ -99,11 +99,9 @@ async function readFlow(flowId: string): Promise<FlowState | null> {
 }
 
 async function writeFlow(flowId: string, state: FlowState): Promise<void> {
-  await upsertKv({
-    namespace: FLOW_NAMESPACE,
-    key: flowId,
-    value: encryptSecret(JSON.stringify(state), getEncryptionKey()),
-    valueType: "string",
+  await upsertCodexDeviceFlow({
+    flowId,
+    state: encryptSecret(JSON.stringify(state), getEncryptionKey()),
     expiresAt: state.expiresAt,
   });
 }

package/src/http/db-query-bounded.ts

@@ -37,6 +37,7 @@
 import { getDb, resolveSqliteVecExtensionPath } from "../be/db";
 import type { DbQueryResult } from "./db-query-shared";
 import {
+  assertNoDeniedTables,
   assertSingleStatement,
   DbQueryConcurrencyCapError,
   DbQueryTimeoutError,
@@ -203,6 +204,8 @@ export async function executeReadOnlyQueryBounded(
   maxRows?: number,
 ): Promise<DbQueryResult> {
   assertSingleStatement(sql);
+  // The child opens its own connection, so the parent checks the program first.
+  assertNoDeniedTables(sql);
   acquireBoundedQuerySlot();
 
   try {

package/src/http/db-query-shared.ts

@@ -56,6 +56,111 @@ export function assertSingleStatement(sql: string): void {
   }
 }
 
+/**
+ * Tables whose rows are credentials: OAuth tokens and client secrets, PKCE
+ * verifiers, API and session token hashes, encrypted script-API bearers, and
+ * encrypted Codex device-login state.
+ * `db-query` is open to every authenticated agent, so it refuses any query
+ * that reads one of these, however the table is reached (alias, CTE, view,
+ * subquery, join or covering index). `swarm_config` stays readable: its
+ * secret values are ciphertext and agents query its non-secret keys.
+ */
+export const DB_QUERY_DENIED_TABLES: ReadonlySet<string> = new Set([
+  "oauth_authorizations",
+  "oauth_apps",
+  "oauth_pending",
+  "user_tokens",
+  "session_tokens",
+  "script_apis",
+  "codex_oauth_device_flows",
+]);
+
+/** Thrown when a query would read a table in {@link DB_QUERY_DENIED_TABLES}. */
+export class DbQueryDeniedTableError extends Error {
+  constructor(readonly tables: string[]) {
+    super(
+      `db-query cannot read ${tables.join(", ")}: ${tables.length === 1 ? "this table holds" : "these tables hold"} credentials. ` +
+        "Use the dedicated OAuth, token or config tools instead.",
+    );
+    this.name = "DbQueryDeniedTableError";
+  }
+}
+
+/** Bytecode opcodes whose p2 is the root page of the b-tree they open. */
+const CURSOR_OPEN_OPCODES = new Set(["OpenRead", "ReopenIdx", "OpenWrite"]);
+
+/**
+ * Open a read-only connection to the swarm database. User SQL is never
+ * prepared on the writable application connection. In-memory databases have
+ * no file to reopen, so they get a read-only snapshot instead.
+ */
+function openReadOnlyReader(): Database {
+  const database = getDb();
+  const reader =
+    !database.filename || database.filename === ":memory:"
+      ? Database.deserialize(database.serialize(), { readonly: true })
+      : new Database(database.filename, { readonly: true });
+  const vecExtensionPath = resolveSqliteVecExtensionPath();
+  if (vecExtensionPath) {
+    try {
+      reader.loadExtension(vecExtensionPath);
+    } catch {
+      // Match the bounded path: only vec queries require the extension.
+    }
+  }
+  return reader;
+}
+
+/**
+ * Reject `sql` if it reads a denied table. Works on the compiled program, not
+ * the SQL text: `EXPLAIN` lists every b-tree the statement opens by root page,
+ * and `sqlite_master` maps root pages (tables and their indexes) back to a
+ * table name. Views, CTEs and subqueries are already expanded in the program,
+ * so no SQL parsing is needed. A user `EXPLAIN ...` returns bytecode, never
+ * row data, so it is allowed as is.
+ */
+export function assertNoDeniedTables(sql: string, reader?: Database): void {
+  const statement = stripTrailingSemicolon(sql);
+  if (/^explain\b/i.test(stripLeadingComments(statement))) return;
+
+  const db = reader ?? openReadOnlyReader();
+  try {
+    const rootPages = new Map<number, string>();
+    for (const row of db
+      .query("SELECT rootpage, tbl_name FROM main.sqlite_master WHERE rootpage > 0")
+      .all() as Array<{ rootpage: number; tbl_name: string }>) {
+      rootPages.set(row.rootpage, row.tbl_name.toLowerCase());
+    }
+
+    using program = db.prepare(`EXPLAIN ${statement}`);
+    const denied = new Set<string>();
+    for (const op of program.all() as Array<{ opcode: string; p2: number; p3: number }>) {
+      // p3 is the schema index: 0 = main. Credential tables only live there.
+      if (!CURSOR_OPEN_OPCODES.has(op.opcode) || op.p3 !== 0) continue;
+      const table = rootPages.get(op.p2);
+      if (table && DB_QUERY_DENIED_TABLES.has(table)) denied.add(table);
+    }
+    if (denied.size > 0) throw new DbQueryDeniedTableError([...denied].sort());
+  } finally {
+    if (!reader) db.close();
+  }
+}
+
+function stripLeadingComments(sql: string): string {
+  let rest = sql.trimStart();
+  for (;;) {
+    if (rest.startsWith("--")) {
+      const end = rest.indexOf("\n");
+      rest = end === -1 ? "" : rest.slice(end + 1).trimStart();
+    } else if (rest.startsWith("/*")) {
+      const end = rest.indexOf("*/");
+      rest = end === -1 ? "" : rest.slice(end + 2).trimStart();
+    } else {
+      return rest;
+    }
+  }
+}
+
 /**
  * Execute a read-only SQL query against the swarm database, synchronously,
  * on the caller's own thread.
@@ -72,22 +177,9 @@ export function executeReadOnlyQuery(
   maxRows?: number,
 ): DbQueryResult {
   assertSingleStatement(sql);
-  const database = getDb();
-  // Never prepare user SQL on the writable application connection. In-memory
-  // databases have no file to reopen, so query a read-only snapshot instead.
-  const reader =
-    !database.filename || database.filename === ":memory:"
-      ? Database.deserialize(database.serialize(), { readonly: true })
-      : new Database(database.filename, { readonly: true });
+  const reader = openReadOnlyReader();
   try {
-    const vecExtensionPath = resolveSqliteVecExtensionPath();
-    if (vecExtensionPath) {
-      try {
-        reader.loadExtension(vecExtensionPath);
-      } catch {
-        // Match the bounded path: only vec queries require the extension.
-      }
-    }
+    assertNoDeniedTables(sql, reader);
     using stmt = reader.prepare(sql);
 
     // Require a result set; SQLite readonly mode is the write barrier.

package/src/http/db-query.ts

@@ -1,5 +1,6 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
+import { scrubObject } from "../utils/secret-scrubber";
 import { executeReadOnlyQueryBounded } from "./db-query-bounded";
 import {
   assertSingleStatement,
@@ -18,7 +19,10 @@ import { json, jsonError } from "./utils";
 
 export type { DbQueryResult } from "./db-query-shared";
 export {
+  assertNoDeniedTables,
   assertSingleStatement,
+  DB_QUERY_DENIED_TABLES,
+  DbQueryDeniedTableError,
   executeReadOnlyQuery,
   getDbQueryHttpBudgetMs,
   getDbQueryHttpMaxRows,
@@ -104,7 +108,9 @@ const dbQueryRoute = route({
         rowLimit: z.number().nullable(),
       }),
     },
-    400: { description: "Invalid or disallowed SQL" },
+    400: {
+      description: "Invalid or disallowed SQL, including queries that read credential tables",
+    },
     408: { description: "Query exceeded its wall-clock budget and was terminated" },
     429: { description: "Too many concurrent bounded db-query executions; retry shortly" },
   },
@@ -131,7 +137,9 @@ export async function handleDbQuery(
       getDbQueryHttpBudgetMs(),
       getDbQueryHttpMaxRows(),
     );
-    dbQueryRoute.respond(res, 200, result);
+    // Rows can hold secrets pasted into free text (task output, logs, events).
+    // The MCP tool gets this from the registrar; the HTTP route does it here.
+    dbQueryRoute.respond(res, 200, scrubObject(result));
   } catch (err: unknown) {
     if (err instanceof DbQueryConcurrencyCapError) {
       // Machine-readable code + Retry-After so a caller can back off instead

package/src/http/index.ts

@@ -26,6 +26,7 @@ import {
   stopAuditWriter,
 } from "../be/rbac-audit";
 import { startScratchScriptGc, stopScratchScriptGc } from "../be/scripts/retention";
+import { loadSecretRegistry } from "../be/secret-registry";
 import { seedLegacyCapabilitiesConfig } from "../be/seed-capabilities";
 import {
   loadEnabledExtensions,
@@ -589,6 +590,22 @@ try {
 }
 warnIfCorsAllowsAnyOrigin();
 
+// Register every stored secret (config secrets of all scopes, OAuth and MCP
+// OAuth credentials, script API tokens) with the scrubber before listen, so
+// egress and the boot retro-sweep below can redact values not touched since
+// the last restart. Non-fatal: a decrypt failure only loses redaction coverage.
+try {
+  const loaded = await loadSecretRegistry();
+  console.log(
+    `[secret-registry] registered config=${loaded.config} oauth=${loaded.oauth} scriptApi=${loaded.scriptApi} failed=${loaded.failed}`,
+  );
+} catch (err) {
+  console.error(
+    "[secret-registry] load failed (non-fatal):",
+    scrubSecrets(err instanceof Error ? err.message : String(err)),
+  );
+}
+
 // Upgrade seed: explicit CAPABILITIES env values that predate capability
 // gating get the previously always-registered groups backfilled into a
 // global swarm_config row (operator-editable; skipped when a row exists).
@@ -809,13 +826,13 @@ httpServer
         console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
       });
 
-    // One-time scrub: retroactively redact any session_logs rows containing
-    // sensitive patterns that pre-date the defense-in-depth scrub layer.
-    // Idempotent, tracked via seed_state.
-    import("../be/boot-scrub-logs")
-      .then(({ runBootScrubLogs }) => runBootScrubLogs())
+    // Versioned retro-sweep: once per SCRUBBER_RULES_VERSION, redact stored
+    // rows (logs, tasks, memory, events, workflow steps) that pre-date the
+    // current scrubber rules. Idempotent and resumable, tracked via seed_state.
+    import("../be/boot-scrub-sweep")
+      .then(({ runBootScrubSweep }) => runBootScrubSweep())
       .catch((err) => {
-        console.error("[boot-scrub-logs] startup scrub failed (non-fatal):", err);
+        console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
       });
   })
   .on("error", (err) => {

package/src/http/mcp.ts

@@ -244,6 +244,11 @@ export async function handleMcp(
       }
       const server = await createServer({
         preloadedTools,
+        // Agent row, then global row, then deployment env. A blank agent row
+        // resolves to "unset" for that agent.
+        enabledTools:
+          configs.find((config) => config.key === "SWARM_ENABLED_TOOLS")?.value ??
+          process.env.SWARM_ENABLED_TOOLS,
         scriptsOnly: resolveScriptsOnlyMode({
           env: process.env.SCRIPTS_ONLY_MCP,
           configValue,

package/src/http/onboarding.ts

@@ -21,6 +21,7 @@ import {
 } from "../be/onboarding";
 import { assertUrlSafe, publicEndpointSsrfOptions } from "../oauth/mcp-wrapper";
 import { ProviderNameSchema } from "../types";
+import { getOpenRouterAttributionHeaders } from "../utils/openrouter-base-url";
 import { ensureConfigAdmin } from "./config";
 import { scheduleIntegrationsReload } from "./core";
 import { route } from "./route-def";
@@ -255,6 +256,7 @@ async function handleMemoryProbe(body: OnboardingMemoryRequest): Promise<Onboard
     const client = new OpenAI({
       baseURL: endpoint.toString(),
       apiKey,
+      defaultHeaders: getOpenRouterAttributionHeaders(endpoint.toString()),
       timeout: 15_000,
       maxRetries: 0,
       fetchOptions: { redirect: "manual" },

package/src/http/script-runs.ts

@@ -23,6 +23,7 @@ import {
   upsertScriptRunJournalStep,
 } from "../be/db";
 import { explicitModelErrorForAgent } from "../be/model-validation";
+import { refuseSourceWithSecrets } from "../be/scripts/source-secrets";
 import { lintWorkflowLabels } from "../script-workflows/label-lint";
 import { scriptRunMaxAgentTasks, scriptRunMaxSteps } from "../script-workflows/limits";
 import {
@@ -40,6 +41,7 @@ import {
   TERMINAL_SCRIPT_RUN_STATUSES,
 } from "../types";
 import { getAppUrl, getMcpBaseUrl } from "../utils/constants";
+import { scrubSecrets } from "../utils/secret-scrubber";
 import {
   executeRawLlm,
   RawLlmConfigSchema,
@@ -369,6 +371,12 @@ export async function handleScriptRuns(
     const agent = await requireAgent(res, agentId);
     if (!agent) return true;
 
+    const secretRefusal = refuseSourceWithSecrets(parsed.body.source);
+    if (secretRefusal) {
+      json(res, secretRefusal, 400);
+      return true;
+    }
+
     const lint = lintWorkflowLabels(parsed.body.source);
     if (!lint.ok) {
       json(
@@ -545,7 +553,7 @@ export async function handleScriptRuns(
         config: parsed.body.config ?? {},
         status: parsed.body.status,
         result: parsed.body.result,
-        error: parsed.body.error,
+        error: parsed.body.error === undefined ? undefined : scrubSecrets(parsed.body.error),
         durationMs: parsed.body.durationMs,
       });
       return assertRunWithinLimits(run.id);

package/src/http/scripts.ts

@@ -32,6 +32,7 @@ import {
 } from "../be/scripts/db";
 import { searchScripts } from "../be/scripts/embeddings";
 import { extractArgsJsonSchema } from "../be/scripts/extract-schema";
+import { refuseSourceWithSecrets } from "../be/scripts/source-secrets";
 import {
   scriptSdkTypesWithGeneratedApis,
   scriptStdlibTypesWithGeneratedApis,
@@ -649,6 +650,12 @@ export async function handleScripts(
       }
     }
 
+    const secretRefusal = refuseSourceWithSecrets(parsed.body.source);
+    if (secretRefusal) {
+      json(res, secretRefusal, 400);
+      return true;
+    }
+
     const typecheck = await typecheckScript(parsed.body.source, { agentId: agent.id });
     if (!typecheck.ok) {
       json(
@@ -716,6 +723,14 @@ export async function handleScripts(
       req.headers["x-runtime-instance-id"],
     );
 
+    // Inline source is saved as a scratch script and recorded on the run row:
+    // refuse an embedded secret before it executes or persists.
+    const secretRefusal = parsed.body.source ? refuseSourceWithSecrets(parsed.body.source) : null;
+    if (secretRefusal) {
+      json(res, secretRefusal, 400);
+      return true;
+    }
+
     let source = parsed.body.source;
     let fsMode = parsed.body.fsMode;
     let namedScript: ScriptRecord | null = null;

package/src/http/workflows.ts

@@ -901,13 +901,14 @@ export async function handleWorkflows(
   if (getWorkflowRunRoute.match(req.method, pathSegments)) {
     const parsed = await getWorkflowRunRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
-    const run = await getWorkflowRun(parsed.params.id);
+    // Display view: the scrubbed context and step outputs, never replay state.
+    const run = await getWorkflowRun(parsed.params.id, "display");
     if (!run) {
       res.writeHead(404);
       res.end();
       return true;
     }
-    const steps = await getWorkflowRunStepsByRunId(parsed.params.id);
+    const steps = await getWorkflowRunStepsByRunId(parsed.params.id, "display");
     getWorkflowRunRoute.respond(res, 200, { run, steps });
     return true;
   }

package/src/oauth/mcp-wrapper.ts

@@ -372,7 +372,7 @@ function formUrlEncodeComponent(value: string): string {
  * at each call site means a new sensitive field cannot forget one shape.
  */
 function redactSentCredentials(text: string, sent: Array<string | null | undefined>): string {
-  let out = scrubSecrets(text);
+  let out: string = scrubSecrets(text);
   for (const value of sent) {
     if (!value) continue;
     for (const shape of new Set([value, formUrlEncodeComponent(value)])) {

package/src/providers/acp-adapter.ts

@@ -410,17 +410,29 @@ export class ACPAdapter implements ProviderAdapter {
   async createSession(config: ProviderSessionConfig): Promise<ProviderSession> {
     const target = this.options.target ?? resolveAcpTarget(config);
     await target.writeSystemPromptArtifact(config);
-    const command = target.command(config);
-    const proc = registerProcessGroup(
-      Bun.spawn(command, {
-        cwd: config.cwd,
-        detached: detachedProcessGroup,
-        env: target.env(config),
-        stdin: "pipe",
-        stdout: "pipe",
-        stderr: "pipe",
-      }),
-    );
+    const cleanupArtifact = async () => {
+      try {
+        await target.cleanupSystemPromptArtifact?.(config);
+      } catch (err) {
+        console.warn(`\x1b[33m[acp]\x1b[0m System prompt cleanup failed: ${formatError(err)}`);
+      }
+    };
+    let proc: Bun.Subprocess<"pipe", "pipe", "pipe">;
+    try {
+      proc = registerProcessGroup(
+        Bun.spawn(target.command(config), {
+          cwd: config.cwd,
+          detached: detachedProcessGroup,
+          env: target.env(config),
+          stdin: "pipe",
+          stdout: "pipe",
+          stderr: "pipe",
+        }),
+      );
+    } catch (err) {
+      await cleanupArtifact();
+      throw err;
+    }
 
     let session: ACPSession | null = null;
     const preSessionEvents: ProviderEvent[] = [];
@@ -499,6 +511,7 @@ export class ACPAdapter implements ProviderAdapter {
         ephemeralToken.tokenId,
       );
       for (const event of preSessionEvents) session.emitFromAcp(event);
+      void session.waitForCompletion().finally(cleanupArtifact);
       return session;
     } catch (err) {
       // Revoke the ephemeral token before re-throwing if ACPSession has not yet
@@ -508,6 +521,7 @@ export class ACPAdapter implements ProviderAdapter {
         void revokeAcpSessionToken(config.apiUrl, config.apiKey, ephemeralToken.tokenId);
       }
       await terminateProcessGroup(proc.pid);
+      await cleanupArtifact();
       throw new Error(
         `ACP target failed during startup: ${describeTargetError(target, scrubSecrets(formatError(err)))}`,
       );