@desplega.ai/agent-swarm 1.172.0 → 2.0.0

package/src/types.ts

@@ -391,6 +391,7 @@ export const AgentTaskSourceSchema = z.enum([
   "linear",
   "jira",
   "comb",
+  "chat",
 ]);
 export type AgentTaskSource = z.infer<typeof AgentTaskSourceSchema>;
 
@@ -446,7 +447,7 @@ export const SteeringStatusSchema = z.enum([
 ]);
 export type SteeringStatus = z.infer<typeof SteeringStatusSchema>;
 
-export const SteeringSourceSchema = z.enum(["ui", "mcp", "script", "slack", "api"]);
+export const SteeringSourceSchema = z.enum(["ui", "mcp", "script", "slack", "api", "chat"]);
 export type SteeringSource = z.infer<typeof SteeringSourceSchema>;
 
 export const SteeringMessageSchema = z
@@ -681,6 +682,10 @@ export const AgentTaskSchema = z
     resolvedModel: z.string().optional(),
     modelSource: z.string().optional(),
     modelAlias: z.string().optional(),
+    // The effort the session ran at (task effort, else the agent's
+    // REASONING_EFFORT_OVERRIDE, dropped when the harness/model cannot take
+    // it). Reported at session start; unset when the harness default applied.
+    resolvedEffort: ReasoningEffortSchema.optional(),
 
     // Schedule linking (optional — set when task was created by a schedule).
     // z.string(): also reachable verbatim from the create-task query param.
@@ -1458,7 +1463,7 @@ export type ChannelType = z.infer<typeof ChannelTypeSchema>;
 export type Channel = z.infer<typeof ChannelSchema>;
 export type ChannelMessage = z.infer<typeof ChannelMessageSchema>;
 
-// Service Types (for PM2/background services)
+// Service Types (removed PM2 service registry; kept with the services table)
 export const ServiceStatusSchema = z.enum(["starting", "healthy", "unhealthy", "stopped"]);
 
 export const ServiceSchema = z
@@ -1834,6 +1839,10 @@ export const SwarmConfigSchema = z
     // auto-encrypted during initDb; if that fails, boot aborts before normal API
     // reads occur.
     encrypted: z.boolean(),
+    // Whether workers export this row into agent process env. False keeps it
+    // server-side (connections, script credential bindings). Always false for
+    // keys only the API server reads (src/utils/config-env-export.ts).
+    exportToEnv: z.boolean(),
   })
   .openapi("SwarmConfig");
 
@@ -2625,6 +2634,7 @@ export type AgentTaskSummary = Pick<
   | "modelSource"
   | "modelAlias"
   | "effort"
+  | "resolvedEffort"
   | "provider"
   | "requestedByUserId"
   | "progress"

package/src/utils/config-env-export.ts

@@ -0,0 +1,74 @@
+/**
+ * Whether a swarm_config row reaches an agent's process environment.
+ *
+ * Each row carries an `exportToEnv` flag (migration 215). Workers export a row
+ * into the harness env, and so into `env`, `printenv` and `/proc/<pid>/environ`
+ * of every agent shell, only when the flag is true. Rows with the flag off stay
+ * server-side: agents use them through a connection or a script credential
+ * binding instead.
+ *
+ * Keys below are read only by the API server (integration signing secrets, app
+ * private keys, OAuth client secrets, the API's own agent-fs key). They can
+ * never be exported: the config API rejects `exportToEnv: true` for them and
+ * every reader treats a stored true as false.
+ */
+export const ENV_EXPORT_RESTRICTED_KEYS: ReadonlySet<string> = new Set([
+  "SLACK_APP_TOKEN",
+  "SLACK_SIGNING_SECRET",
+  "GITHUB_APP_PRIVATE_KEY",
+  "GITHUB_WEBHOOK_SECRET",
+  "GITLAB_WEBHOOK_SECRET",
+  "LINEAR_CLIENT_SECRET",
+  "LINEAR_SIGNING_SECRET",
+  "JIRA_CLIENT_SECRET",
+  "JIRA_WEBHOOK_TOKEN",
+  "AZURE_DEVOPS_WEBHOOK_SECRET",
+  "AGENTMAIL_WEBHOOK_SECRET",
+  "API_AGENT_FS_API_KEY",
+]);
+
+/**
+ * Server-side secrets an operator may still export per row. A new row for one
+ * of these keys starts with the flag off unless the caller sends
+ * `exportToEnv: true`. Migration 215 applies the same default to rows that
+ * already existed.
+ */
+export const ENV_EXPORT_DEFAULT_OFF_KEYS: ReadonlySet<string> = new Set([
+  "KAPSO_WEBHOOK_HMAC_SECRET",
+  "SENTRY_TEST_APP_WEBHOOK_SECRET",
+  "TELEMETRY_CH_AUTH",
+  "HACK_AGENT_FS_ADMIN_KEY",
+  "X_CLIENT_SECRET",
+]);
+
+/** Script connection secrets (`connection.<slug>.secret`) are brokered server-side. */
+const CONNECTION_SECRET_KEY = /^connection\..+\.secret$/;
+
+/**
+ * Key prefixes whose rows start with the flag off: the API server reads them
+ * (Chat SDK bot tokens and adapter JSON), agents never need them in a shell.
+ */
+const ENV_EXPORT_DEFAULT_OFF_PREFIXES = ["CHAT_SDK_"];
+
+export function isEnvExportRestrictedKey(key: string): boolean {
+  return ENV_EXPORT_RESTRICTED_KEYS.has(key.toUpperCase()) || CONNECTION_SECRET_KEY.test(key);
+}
+
+/** The flag a new row gets when the caller does not send one. */
+export function defaultExportToEnv(key: string): boolean {
+  const upper = key.toUpperCase();
+  return (
+    !isEnvExportRestrictedKey(key) &&
+    !ENV_EXPORT_DEFAULT_OFF_KEYS.has(upper) &&
+    !ENV_EXPORT_DEFAULT_OFF_PREFIXES.some((prefix) => upper.startsWith(prefix))
+  );
+}
+
+export function envExportRestrictedError(key: string): string {
+  return `Key '${key}' is read only by the API server and can never be exported to agent env; store it with exportToEnv: false.`;
+}
+
+/** The flag readers act on: a stored true never wins for a restricted key. */
+export function effectiveExportToEnv(key: string, stored: boolean): boolean {
+  return stored && !isEnvExportRestrictedKey(key);
+}

package/src/utils/credentials.test.ts

@@ -1,6 +1,8 @@
 import { describe, expect, it } from "bun:test";
+import { OPENAI_COMPATIBLE_PROVIDERS } from "@desplega/model-catalog";
 import {
   CREDENTIAL_POOL_VARS,
+  deriveProviderFromKeyType,
   getModelAwareCredentialVars,
   resolveCredentialPools,
   selectRandomCredential,
@@ -123,6 +125,35 @@ describe("resolveCredentialPools", () => {
     expect(["example-oauth1", "example-oauth2"]).toContain(env.CLAUDE_CODE_OAUTH_TOKEN!);
     expect(["example-apikey1", "example-apikey2"]).toContain(env.ANTHROPIC_API_KEY!);
   });
+
+  it("pools NAN_API_KEY alone for an opencode nan/* model", async () => {
+    const env: Record<string, string | undefined> = {
+      NAN_API_KEY: "example-nan-a,example-nan-b,example-nan-c",
+      OPENROUTER_API_KEY: "example-or-a,example-or-b",
+    };
+    const selections = await resolveCredentialPools(env, {
+      provider: "opencode",
+      model: "nan/glm5.3-flash",
+    });
+    expect(["example-nan-a", "example-nan-b", "example-nan-c"]).toContain(env.NAN_API_KEY!);
+    expect(selections).toHaveLength(1);
+    expect(selections[0]?.keyType).toBe("NAN_API_KEY");
+    expect(selections[0]?.total).toBe(3);
+    // OpenRouter is not relevant to a nan/* model and stays untouched.
+    expect(env.OPENROUTER_API_KEY).toBe("example-or-a,example-or-b");
+  });
+
+  it("pools HELMCODE_API_KEY alone for a pi helmcode/* model", async () => {
+    const env: Record<string, string | undefined> = {
+      HELMCODE_API_KEY: "example-helm-a,example-helm-b",
+    };
+    const selections = await resolveCredentialPools(env, {
+      provider: "pi",
+      model: "helmcode/glm5.3",
+    });
+    expect(["example-helm-a", "example-helm-b"]).toContain(env.HELMCODE_API_KEY!);
+    expect(selections.map((s) => s.keyType)).toEqual(["HELMCODE_API_KEY"]);
+  });
 });
 
 describe("validateClaudeCredentials", () => {
@@ -198,6 +229,23 @@ describe("CREDENTIAL_POOL_VARS", () => {
   it("contains expected env var names", () => {
     expect(CREDENTIAL_POOL_VARS).toContain("CLAUDE_CODE_OAUTH_TOKEN");
     expect(CREDENTIAL_POOL_VARS).toContain("ANTHROPIC_API_KEY");
+    expect(CREDENTIAL_POOL_VARS).toContain("NAN_API_KEY");
+    expect(CREDENTIAL_POOL_VARS).toContain("HELMCODE_API_KEY");
+  });
+
+  it("pools only the canonical NaN var; the alias is normalized by the runner", () => {
+    expect(OPENAI_COMPATIBLE_PROVIDERS.nan.aliasEnvVars).toEqual(["HELMCODE_API_NAN"]);
+    expect(CREDENTIAL_POOL_VARS as readonly string[]).not.toContain("HELMCODE_API_NAN");
+  });
+});
+
+describe("deriveProviderFromKeyType", () => {
+  it("tags NaN and Helmcode keys as pi, like OpenRouter", () => {
+    for (const keyType of ["NAN_API_KEY", "HELMCODE_API_NAN", "HELMCODE_API_KEY"]) {
+      expect(deriveProviderFromKeyType(keyType)).toBe("pi");
+    }
+    expect(deriveProviderFromKeyType("OPENROUTER_API_KEY")).toBe("pi");
+    expect(deriveProviderFromKeyType("SOMETHING_ELSE")).toBe("claude");
   });
 });
 
@@ -266,4 +314,48 @@ describe("getModelAwareCredentialVars", () => {
     const vars = getModelAwareCredentialVars("opencode", "anthropic/claude-sonnet-4-20250514");
     expect(vars).not.toContain("OPENAI_API_KEY");
   });
+
+  it("routes nan/* and helmcode/* to their own key on pi and opencode", () => {
+    for (const provider of ["pi", "opencode"]) {
+      expect(getModelAwareCredentialVars(provider, "nan/glm5.3-flash")).toEqual(["NAN_API_KEY"]);
+      expect(getModelAwareCredentialVars(provider, "helmcode/glm5.3")).toEqual([
+        "HELMCODE_API_KEY",
+      ]);
+      // Only the exact prefix routes: a look-alike is any other provider/model.
+      const other = getModelAwareCredentialVars(provider, "other/x");
+      expect(getModelAwareCredentialVars(provider, "helmcodex/x")).toEqual(other);
+      expect(getModelAwareCredentialVars(provider, "nanx/y")).toEqual(other);
+      expect(other).not.toContain("NAN_API_KEY");
+      expect(other).not.toContain("HELMCODE_API_KEY");
+    }
+  });
+
+  it("keeps OpenRouter and bare-id routing byte-identical", () => {
+    for (const provider of ["pi", "opencode"]) {
+      expect(
+        getModelAwareCredentialVars(provider, "openrouter/deepseek/deepseek-v4-flash"),
+      ).toEqual(["OPENROUTER_API_KEY", "ANTHROPIC_API_KEY"]);
+      expect(getModelAwareCredentialVars(provider, "openai/gpt-5")).toEqual([
+        "OPENROUTER_API_KEY",
+        "ANTHROPIC_API_KEY",
+      ]);
+      expect(getModelAwareCredentialVars(provider, "gpt-4o")).toEqual([
+        "OPENROUTER_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "OPENAI_API_KEY",
+      ]);
+      // A NaN model routed through OpenRouter is still an OpenRouter model.
+      expect(getModelAwareCredentialVars(provider, "openrouter/nan/glm5.3")).toEqual([
+        "OPENROUTER_API_KEY",
+        "ANTHROPIC_API_KEY",
+      ]);
+    }
+  });
+
+  it("does not apply the nan/helmcode prefix routing to other harnesses", () => {
+    expect(getModelAwareCredentialVars("claude", "nan/glm5.3")).toEqual([
+      "CLAUDE_CODE_OAUTH_TOKEN",
+      "ANTHROPIC_API_KEY",
+    ]);
+  });
 });

package/src/utils/credentials.ts

@@ -1,4 +1,10 @@
 import { existsSync } from "node:fs";
+import {
+  openAICompatibleProviders,
+  providerForKeyVar,
+  providerForModel,
+  providerKeyVars,
+} from "@desplega/model-catalog";
 import { deriveDefaultRoute, routeCredentialStatus } from "@desplega/model-routing";
 import { type ModelFamily, modelFamilyOf, windowForModelFamily } from "./model-rate-limit-windows";
 
@@ -14,8 +20,27 @@ export const CREDENTIAL_POOL_VARS = [
   "AMP_API_KEY",
   "CURSOR_API_KEY",
   "XAI_API_KEY",
+  // The canonical key var of every OpenAI-compatible registry provider
+  // (`@desplega/model-catalog`). Aliases are normalized into these by the
+  // runner (`normalizeProviderKeyAliases`), so they never pool.
+  ...openAICompatibleProviders().map((p) => p.envVar),
 ] as const;
 
+/**
+ * Copy the first set alias of each registry provider into its canonical key
+ * var when the canonical var is empty (`HELMCODE_API_NAN` → `NAN_API_KEY`).
+ * The runner runs this once per task, so pooling, credential checks, pi's
+ * runtime key and the opencode key splice only read the canonical name. An
+ * explicit canonical value wins. Mutates `env`.
+ */
+export function normalizeProviderKeyAliases(env: Record<string, string | undefined>): void {
+  for (const provider of openAICompatibleProviders()) {
+    if (env[provider.envVar]?.trim()) continue;
+    const alias = provider.aliasEnvVars.find((name) => env[name]?.trim());
+    if (alias) env[provider.envVar] = env[alias];
+  }
+}
+
 /**
  * Which credential env vars are relevant for each harness provider. The
  * runner uses this map to filter `CREDENTIAL_POOL_VARS` so a codex worker
@@ -76,6 +101,10 @@ export function getModelAwareCredentialVars(provider: string, model?: string): r
     return model.startsWith("openrouter/") ? ["OPENROUTER_API_KEY"] : ["XAI_API_KEY"];
   }
   if (!SLASH_MODEL_PROVIDERS.has(provider) || !model) return base;
+  // OpenAI-compatible registry providers own their key: `nan/<id>` and
+  // `helmcode/<id>` never pool an OpenRouter or Anthropic key.
+  const direct = providerForModel(model);
+  if (direct) return [direct.envVar];
   if (model.includes("/")) {
     return base.filter((v) => v !== "OPENAI_API_KEY");
   }
@@ -91,6 +120,8 @@ export function getModelAwareCredentialVars(provider: string, model?: string): r
  * usage with the active worker's HARNESS_PROVIDER.
  */
 export function deriveProviderFromKeyType(keyType: string): string {
+  // OpenAI-compatible registry keys (canonical or alias) default to pi.
+  if (providerForKeyVar(keyType)) return "pi";
   switch (keyType) {
     case "CLAUDE_CODE_OAUTH_TOKEN":
     case "ANTHROPIC_API_KEY":
@@ -210,7 +241,7 @@ function isJsonObject(value: string): boolean {
  * Falls back to random selection from all credentials if no available indices match.
  * A JSON object value (the CODEX_OAUTH blob) is always one credential.
  */
-function splitCredentialPool(value: string): string[] {
+export function splitCredentialPool(value: string): string[] {
   return isJsonObject(value)
     ? [value.trim()]
     : value
@@ -311,21 +342,38 @@ export function validateClaudeCredentials(env: Record<string, string | undefined
   return CLAUDE_CREDENTIAL_TYPE_BY_PROVIDER[route.provider] ?? route.provider;
 }
 
+/**
+ * One label per OpenAI-compatible registry provider for hints and errors:
+ * `NAN_API_KEY (or HELMCODE_API_NAN)`, `HELMCODE_API_KEY`.
+ */
+export function openAICompatibleKeyLabels(): string[] {
+  return openAICompatibleProviders().map((p) =>
+    p.aliasEnvVars.length > 0 ? `${p.envVar} (or ${p.aliasEnvVars.join(" or ")})` : p.envVar,
+  );
+}
+
 /**
  * Validate that at least one opencode credential is available.
- * Priority: OPENROUTER_API_KEY → ANTHROPIC_API_KEY → OPENAI_API_KEY → ~/.local/share/opencode/auth.json.
+ * Priority: OPENROUTER_API_KEY → ANTHROPIC_API_KEY → OPENAI_API_KEY → each
+ * OpenAI-compatible registry provider's key (canonical or alias, e.g.
+ * NAN_API_KEY or HELMCODE_API_NAN → `nan_api_key`) →
+ * ~/.local/share/opencode/auth.json.
  * Returns the credential type found, or throws if none are available.
  */
 export function validateOpencodeCredentials(
   env: Record<string, string | undefined>,
-): "openrouter_api_key" | "anthropic_api_key" | "openai_api_key" | "auth_file" {
+): "openrouter_api_key" | "anthropic_api_key" | "openai_api_key" | Lowercase<string> | "auth_file" {
   if (env.OPENROUTER_API_KEY) return "openrouter_api_key";
   if (env.ANTHROPIC_API_KEY) return "anthropic_api_key";
   if (env.OPENAI_API_KEY) return "openai_api_key";
+  const direct = openAICompatibleProviders().find((p) => providerKeyVars(p).some((n) => env[n]));
+  if (direct) return direct.envVar.toLowerCase() as Lowercase<string>;
   const authFile = `${process.env.HOME ?? "/root"}/.local/share/opencode/auth.json`;
   if (existsSync(authFile)) return "auth_file";
   throw new Error(
-    "No opencode credentials found. Set OPENROUTER_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY, or provide ~/.local/share/opencode/auth.json.",
+    `No opencode credentials found. Set OPENROUTER_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY, ${openAICompatibleKeyLabels()
+      .map((label) => `${label}, `)
+      .join("")}or provide ~/.local/share/opencode/auth.json.`,
   );
 }
 

package/src/utils/harness-provider.ts

@@ -1,3 +1,4 @@
+import { openAICompatibleKeyVars } from "@desplega/model-catalog";
 import { type ProviderName, ProviderNameSchema } from "../types";
 
 const SUPPORTED_PROVIDERS = ProviderNameSchema.options;
@@ -10,23 +11,31 @@ function hasEnvValue(
   return !!(resolvedEnv[key]?.trim() || fallbackEnv[key]?.trim());
 }
 
+/**
+ * LLM keys that make "pi" the default harness when no Claude credential is
+ * set: OpenRouter plus every OpenAI-compatible registry key (canonical or alias).
+ */
+const PI_DEFAULT_KEY_VARS = ["OPENROUTER_API_KEY", ...openAICompatibleKeyVars()];
+
 /**
  * Credential-aware default for when HARNESS_PROVIDER is unset or invalid.
  * Unconditionally defaulting to "claude" leaves an OpenRouter-only swarm —
  * e.g. every auto-deployed swarm, which is provisioned with
  * OPENROUTER_API_KEY and NEVER an Anthropic credential — unable to
- * authenticate at all. Prefer "pi" when an OpenRouter key is present and no
- * Claude credential is; otherwise keep the original "claude" default.
+ * authenticate at all. Prefer "pi" when an OpenRouter key or an
+ * OpenAI-compatible registry key (NaN, Helmcode; canonical or alias) is
+ * present and no Claude credential is; otherwise keep the original "claude"
+ * default.
  */
 function credentialAwareDefault(
   resolvedEnv: Record<string, string | undefined>,
   fallbackEnv: Record<string, string | undefined>,
 ): ProviderName {
-  const hasOpenRouterKey = hasEnvValue("OPENROUTER_API_KEY", resolvedEnv, fallbackEnv);
+  const hasPiKey = PI_DEFAULT_KEY_VARS.some((key) => hasEnvValue(key, resolvedEnv, fallbackEnv));
   const hasClaudeCredential =
     hasEnvValue("ANTHROPIC_API_KEY", resolvedEnv, fallbackEnv) ||
     hasEnvValue("CLAUDE_CODE_OAUTH_TOKEN", resolvedEnv, fallbackEnv);
-  return hasOpenRouterKey && !hasClaudeCredential ? "pi" : "claude";
+  return hasPiKey && !hasClaudeCredential ? "pi" : "claude";
 }
 
 /**
@@ -36,8 +45,8 @@ function credentialAwareDefault(
  *   1. `resolvedEnv.HARNESS_PROVIDER` — value coming from `swarm_config`
  *      (overlay produced by `fetchResolvedEnv`, scoped repo > agent > global).
  *   2. `fallbackEnv.HARNESS_PROVIDER` — raw `process.env`.
- *   3. Credential-aware default — "pi" when an OpenRouter key is present and
- *      no Anthropic credential is (see `credentialAwareDefault`), else
+ *   3. Credential-aware default — "pi" when an OpenRouter or registry
+ *      provider key is present and no Anthropic credential is (see `credentialAwareDefault`), else
  *      `"claude"`.
  *
  * Invalid values (anything outside `ProviderNameSchema`) log a warning and

package/src/utils/node-env.ts

@@ -0,0 +1,24 @@
+/**
+ * Runtime read of `NODE_ENV`.
+ *
+ * `bun build --compile` replaces every dot read of `NODE_ENV` on `process.env`
+ * with the build-time constant "development", so the compiled API and worker
+ * binaries never see the deployment's value. A computed key is not inlined.
+ * Read `NODE_ENV` through this helper only. `src/tests/node-env-runtime.test.ts`
+ * compiles a binary to prove it; `scripts/check-node-env-access.sh` rejects new
+ * dot reads in `src/`.
+ */
+const NODE_ENV_KEY = "NODE_ENV";
+
+export function getNodeEnv(): string | undefined {
+  return process.env[NODE_ENV_KEY];
+}
+
+/**
+ * True only for an explicit development or test environment. Deployed images
+ * leave NODE_ENV unset, so unset (and any other value) fails closed.
+ */
+export function isDevOrTestNodeEnv(): boolean {
+  const env = getNodeEnv();
+  return env === "development" || env === "test";
+}

package/src/utils/runtime-model-catalog.ts

@@ -17,6 +17,7 @@
  * NO database imports (worker-safe). Every lookup is synchronous; the HTTP
  * refresh is TTL-cached and never throws, so hot paths stay cheap.
  */
+import { type CatalogChatRow, withRegistryCatalogSections } from "@desplega/model-catalog";
 import modelsDevSnapshot from "../be/modelsdev-cache.json";
 
 export interface RuntimeCatalogModel {
@@ -38,7 +39,16 @@ export interface RuntimeCatalogProvider {
 
 export type RuntimeCatalog = Record<string, RuntimeCatalogProvider | undefined>;
 
-const SNAPSHOT = modelsDevSnapshot as RuntimeCatalog;
+// Plus the registry-synthesized sections models.dev does not list (`helmcode`).
+const SNAPSHOT = withRegistryCatalogSections(modelsDevSnapshot as RuntimeCatalog);
+
+/**
+ * One section's full snapshot rows (output limit, modalities, tool calling),
+ * which the slim live catalog drops. Harness config blocks read these.
+ */
+export function snapshotCatalogRows(provider: string): Record<string, CatalogChatRow> {
+  return (SNAPSHOT[provider]?.models ?? {}) as Record<string, CatalogChatRow>;
+}
 
 /** Default freshness window for the worker-side HTTP pull. */
 export const RUNTIME_CATALOG_TTL_MS = 10 * 60_000;

package/src/utils/secret-scrubber.ts

@@ -21,6 +21,7 @@
  * API↔worker DB boundary (scripts/check-db-boundary.sh).
  */
 
+import { openAICompatibleKeyVars } from "@desplega/model-catalog";
 import { GITLEAKS_RULES } from "./secret-rules.generated";
 
 /**
@@ -35,9 +36,13 @@ import { GITLEAKS_RULES } from "./secret-rules.generated";
  * 5, the vendored gitleaks rule set, plus hand-written Resend, Google OAuth,
  * Discord webhook, xAI and bare Telegram shapes in pass 2; v6 = pass 5 resumes
  * after the secret, not the match, so adjacent secrets that share a delimiter
- * both redact, and sourcegraph-access-token drops its bare 40-hex branch.
+ * both redact, and sourcegraph-access-token drops its bare 40-hex branch;
+ * v7 = the OpenAI-compatible registry key vars (`NAN_API_KEY`,
+ * `HELMCODE_API_KEY`, and the `HELMCODE_API_NAN` alias no suffix matches).
+ * A new registry entry adds key vars, so it is a rule change too
+ * (`secret-scrubber.test.ts` pins the list to this number).
  */
-export const SCRUBBER_RULES_VERSION = 6;
+export const SCRUBBER_RULES_VERSION = 8;
 
 /** Env-var names that are always considered secrets, even without suffix hints. */
 const SENSITIVE_KEY_EXACT = new Set<string>([
@@ -52,6 +57,9 @@ const SENSITIVE_KEY_EXACT = new Set<string>([
   "ANTHROPIC_API_KEY",
   "OPENAI_API_KEY",
   "OPENROUTER_API_KEY",
+  // OpenAI-compatible registry key vars, canonical and alias. An alias such
+  // as `HELMCODE_API_NAN` matches no SENSITIVE_KEY_SUFFIXES entry.
+  ...openAICompatibleKeyVars(),
   "SLACK_BOT_TOKEN",
   "SLACK_SIGNING_SECRET",
   "SLACK_CLIENT_SECRET",
@@ -1005,6 +1013,52 @@ export function scrubObject<T>(value: T, seen = new WeakSet<object>()): T {
   return out as T;
 }
 
+export type ValueScrubber = {
+  text(text: string): string;
+  object<T>(value: T): T;
+};
+
+/**
+ * Redact exact occurrences of the given values, at any length, in one output
+ * boundary that knows which secrets it handed out (a script run's secret
+ * config). The global passes above keep their MIN_VALUE_LENGTH floor; this
+ * one never registers anything swarm-wide. All forms match in a single regex
+ * pass, longest first, so one value's marker is never rewritten by another
+ * value's pass. Object keys are redacted too.
+ */
+export function createValueScrubber(
+  entries: Array<{ value: string; name: string }>,
+): ValueScrubber {
+  const names = new Map<string, string>();
+  for (const { value, name } of entries) {
+    if (!value) continue;
+    for (const form of escapedForms(value)) if (!names.has(form)) names.set(form, name);
+  }
+  if (names.size === 0) return { text: (text) => text, object: (value) => value };
+
+  const pattern = [...names.keys()]
+    .sort((a, b) => b.length - a.length)
+    .map(escapeRegExp)
+    .join("|");
+  const re = new RegExp(pattern, "g");
+  const text = (input: string) =>
+    input.replace(re, (match) => `[REDACTED:${names.get(match) ?? "secret"}]`);
+  const object = <T>(value: T, seen = new WeakSet<object>()): T => {
+    if (typeof value === "string") return text(value) as T;
+    if (value === null || typeof value !== "object") return value;
+    if (seen.has(value)) return "[Circular]" as T;
+    seen.add(value);
+    if (Array.isArray(value)) return value.map((item) => object(item, seen)) as T;
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>).map(([key, child]) => [
+        text(key),
+        object(child, seen),
+      ]),
+    ) as T;
+  };
+  return { text, object: (value) => object(value) };
+}
+
 /**
  * Force the env-value cache to rebuild on the next scrub call. Callers should
  * invoke this whenever the swarm_config is reloaded (`/internal/reload-config`
@@ -1031,6 +1085,21 @@ export function registerVolatileSecret(value: string, name: string): void {
   }
 }
 
+/**
+ * Register the sensitive values of an env map that is not `process.env`
+ * (a runner's per-task env, an adapter's session env). A key picked from a
+ * credential pool, or a row admitted after boot, lives only there, so the
+ * env pass never sees it. Comma-separated pools register each member too.
+ */
+export function registerEnvSecrets(env: Record<string, string | undefined>): void {
+  for (const [key, value] of Object.entries(env)) {
+    if (!value || !isSensitiveKey(key)) continue;
+    registerVolatileSecret(value, key);
+    if (!value.includes(",")) continue;
+    for (const member of value.split(",")) registerVolatileSecret(member.trim(), key);
+  }
+}
+
 /** Remove a short-lived secret and its encoded forms after credential revocation. */
 export function unregisterVolatileSecret(name: string): void {
   for (const [value, registeredName] of volatileSecrets) {

package/src/utils/task-tool-manifest.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { chatThreadOfContextKey } from "../tasks/context-key";
 import { ALL_TOOLS } from "../tools/tool-config";
 
 const toolNames = z
@@ -15,9 +16,22 @@ export function parseTaskToolManifest(value: string) {
   return taskToolManifestSchema.parse(JSON.parse(value));
 }
 
+/** Tools that act on the chat thread of the calling task; useless on any other task. */
+export const CHAT_TASK_ONLY_TOOLS: readonly string[] = ["chat-reply"];
+
+/** True when the task came from a Chat SDK thread (contextKey family `chat-sdk`). */
+export function isChatSdkTask(task: { contextKey?: string | null }): boolean {
+  return chatThreadOfContextKey(task.contextKey) !== null;
+}
+
 export function selectTaskTools(
   manifest: z.infer<typeof taskToolManifestSchema>,
-  task: { taskType?: string; scheduleId?: string; slackChannelId?: string },
+  task: {
+    taskType?: string;
+    scheduleId?: string;
+    slackChannelId?: string;
+    contextKey?: string | null;
+  },
 ): string[] {
   const fromSchedule =
     task.scheduleId && Object.hasOwn(manifest.schedules ?? {}, task.scheduleId)
@@ -27,7 +41,10 @@ export function selectTaskTools(
     task.taskType && Object.hasOwn(manifest.taskTypes ?? {}, task.taskType)
       ? manifest.taskTypes?.[task.taskType]
       : undefined;
+  const chatTask = isChatSdkTask(task);
   return [...new Set(fromSchedule ?? fromType ?? [])].filter(
-    (name) => !name.startsWith("slack-") || Boolean(task.slackChannelId),
+    (name) =>
+      (!name.startsWith("slack-") || Boolean(task.slackChannelId)) &&
+      (chatTask || !CHAT_TASK_ONLY_TOOLS.includes(name)),
   );
 }

package/src/workflows/executors/swarm-script.ts

@@ -127,6 +127,7 @@ export class SwarmScriptExecutor extends BaseExecutor<
       mcpBaseUrl: getMcpBaseUrl(),
       egressSecrets: credentials.egressSecrets,
       failedBindings: credentials.failedBindings,
+      userConfig: credentials.userConfig,
       apiConnections: getScriptApiConnectionDescriptors({ agentId: agentId ?? undefined }),
       mcpConnections: getScriptMcpConnectionDescriptors({ agentId: agentId ?? undefined }),
       timeoutMs: config.timeoutMs,

package/templates/skills/agent-browser/SKILL.md

@@ -84,7 +84,7 @@ agent-fs share-create thoughts/<agent-id>/qa/<topic>-screenshots/<name>.png --js
 - In `store-progress`, list the upload in the `attachments` field with `kind: "agent-fs"` and the path, and paste the `share-create` link for people who need to open the file.
 - If `agent-fs auth whoami` fails, report the local path, say the upload was skipped, and continue.
 
-The `artifacts` skill holds the full agent-fs recipe and the naming conventions.
+The `agent-fs` skill holds the full agent-fs recipe.
 
 ## Gotchas
 

package/templates/skills/agent-browser/content.md

@@ -79,7 +79,7 @@ agent-fs share-create thoughts/<agent-id>/qa/<topic>-screenshots/<name>.png --js
 - In `store-progress`, list the upload in the `attachments` field with `kind: "agent-fs"` and the path, and paste the `share-create` link for people who need to open the file.
 - If `agent-fs auth whoami` fails, report the local path, say the upload was skipped, and continue.
 
-The `artifacts` skill holds the full agent-fs recipe and the naming conventions.
+The `agent-fs` skill holds the full agent-fs recipe.
 
 ## Gotchas