@desplega.ai/agent-swarm 1.173.0 → 2.1.0

package/src/utils/config-env-export.ts

@@ -0,0 +1,74 @@
+/**
+ * Whether a swarm_config row reaches an agent's process environment.
+ *
+ * Each row carries an `exportToEnv` flag (migration 215). Workers export a row
+ * into the harness env, and so into `env`, `printenv` and `/proc/<pid>/environ`
+ * of every agent shell, only when the flag is true. Rows with the flag off stay
+ * server-side: agents use them through a connection or a script credential
+ * binding instead.
+ *
+ * Keys below are read only by the API server (integration signing secrets, app
+ * private keys, OAuth client secrets, the API's own agent-fs key). They can
+ * never be exported: the config API rejects `exportToEnv: true` for them and
+ * every reader treats a stored true as false.
+ */
+export const ENV_EXPORT_RESTRICTED_KEYS: ReadonlySet<string> = new Set([
+  "SLACK_APP_TOKEN",
+  "SLACK_SIGNING_SECRET",
+  "GITHUB_APP_PRIVATE_KEY",
+  "GITHUB_WEBHOOK_SECRET",
+  "GITLAB_WEBHOOK_SECRET",
+  "LINEAR_CLIENT_SECRET",
+  "LINEAR_SIGNING_SECRET",
+  "JIRA_CLIENT_SECRET",
+  "JIRA_WEBHOOK_TOKEN",
+  "AZURE_DEVOPS_WEBHOOK_SECRET",
+  "AGENTMAIL_WEBHOOK_SECRET",
+  "API_AGENT_FS_API_KEY",
+]);
+
+/**
+ * Server-side secrets an operator may still export per row. A new row for one
+ * of these keys starts with the flag off unless the caller sends
+ * `exportToEnv: true`. Migration 215 applies the same default to rows that
+ * already existed.
+ */
+export const ENV_EXPORT_DEFAULT_OFF_KEYS: ReadonlySet<string> = new Set([
+  "KAPSO_WEBHOOK_HMAC_SECRET",
+  "SENTRY_TEST_APP_WEBHOOK_SECRET",
+  "TELEMETRY_CH_AUTH",
+  "HACK_AGENT_FS_ADMIN_KEY",
+  "X_CLIENT_SECRET",
+]);
+
+/** Script connection secrets (`connection.<slug>.secret`) are brokered server-side. */
+const CONNECTION_SECRET_KEY = /^connection\..+\.secret$/;
+
+/**
+ * Key prefixes whose rows start with the flag off: the API server reads them
+ * (Chat SDK bot tokens and adapter JSON), agents never need them in a shell.
+ */
+const ENV_EXPORT_DEFAULT_OFF_PREFIXES = ["CHAT_SDK_"];
+
+export function isEnvExportRestrictedKey(key: string): boolean {
+  return ENV_EXPORT_RESTRICTED_KEYS.has(key.toUpperCase()) || CONNECTION_SECRET_KEY.test(key);
+}
+
+/** The flag a new row gets when the caller does not send one. */
+export function defaultExportToEnv(key: string): boolean {
+  const upper = key.toUpperCase();
+  return (
+    !isEnvExportRestrictedKey(key) &&
+    !ENV_EXPORT_DEFAULT_OFF_KEYS.has(upper) &&
+    !ENV_EXPORT_DEFAULT_OFF_PREFIXES.some((prefix) => upper.startsWith(prefix))
+  );
+}
+
+export function envExportRestrictedError(key: string): string {
+  return `Key '${key}' is read only by the API server and can never be exported to agent env; store it with exportToEnv: false.`;
+}
+
+/** The flag readers act on: a stored true never wins for a restricted key. */
+export function effectiveExportToEnv(key: string, stored: boolean): boolean {
+  return stored && !isEnvExportRestrictedKey(key);
+}

package/src/utils/credentials.test.ts

@@ -1,6 +1,8 @@
 import { describe, expect, it } from "bun:test";
+import { OPENAI_COMPATIBLE_PROVIDERS } from "@desplega/model-catalog";
 import {
   CREDENTIAL_POOL_VARS,
+  deriveProviderFromKeyType,
   getModelAwareCredentialVars,
   resolveCredentialPools,
   selectRandomCredential,
@@ -123,6 +125,35 @@ describe("resolveCredentialPools", () => {
     expect(["example-oauth1", "example-oauth2"]).toContain(env.CLAUDE_CODE_OAUTH_TOKEN!);
     expect(["example-apikey1", "example-apikey2"]).toContain(env.ANTHROPIC_API_KEY!);
   });
+
+  it("pools NAN_API_KEY alone for an opencode nan/* model", async () => {
+    const env: Record<string, string | undefined> = {
+      NAN_API_KEY: "example-nan-a,example-nan-b,example-nan-c",
+      OPENROUTER_API_KEY: "example-or-a,example-or-b",
+    };
+    const selections = await resolveCredentialPools(env, {
+      provider: "opencode",
+      model: "nan/glm5.3-flash",
+    });
+    expect(["example-nan-a", "example-nan-b", "example-nan-c"]).toContain(env.NAN_API_KEY!);
+    expect(selections).toHaveLength(1);
+    expect(selections[0]?.keyType).toBe("NAN_API_KEY");
+    expect(selections[0]?.total).toBe(3);
+    // OpenRouter is not relevant to a nan/* model and stays untouched.
+    expect(env.OPENROUTER_API_KEY).toBe("example-or-a,example-or-b");
+  });
+
+  it("pools HELMCODE_API_KEY alone for a pi helmcode/* model", async () => {
+    const env: Record<string, string | undefined> = {
+      HELMCODE_API_KEY: "example-helm-a,example-helm-b",
+    };
+    const selections = await resolveCredentialPools(env, {
+      provider: "pi",
+      model: "helmcode/glm5.3",
+    });
+    expect(["example-helm-a", "example-helm-b"]).toContain(env.HELMCODE_API_KEY!);
+    expect(selections.map((s) => s.keyType)).toEqual(["HELMCODE_API_KEY"]);
+  });
 });
 
 describe("validateClaudeCredentials", () => {
@@ -198,6 +229,23 @@ describe("CREDENTIAL_POOL_VARS", () => {
   it("contains expected env var names", () => {
     expect(CREDENTIAL_POOL_VARS).toContain("CLAUDE_CODE_OAUTH_TOKEN");
     expect(CREDENTIAL_POOL_VARS).toContain("ANTHROPIC_API_KEY");
+    expect(CREDENTIAL_POOL_VARS).toContain("NAN_API_KEY");
+    expect(CREDENTIAL_POOL_VARS).toContain("HELMCODE_API_KEY");
+  });
+
+  it("pools only the canonical NaN var; the alias is normalized by the runner", () => {
+    expect(OPENAI_COMPATIBLE_PROVIDERS.nan.aliasEnvVars).toEqual(["HELMCODE_API_NAN"]);
+    expect(CREDENTIAL_POOL_VARS as readonly string[]).not.toContain("HELMCODE_API_NAN");
+  });
+});
+
+describe("deriveProviderFromKeyType", () => {
+  it("tags NaN and Helmcode keys as pi, like OpenRouter", () => {
+    for (const keyType of ["NAN_API_KEY", "HELMCODE_API_NAN", "HELMCODE_API_KEY"]) {
+      expect(deriveProviderFromKeyType(keyType)).toBe("pi");
+    }
+    expect(deriveProviderFromKeyType("OPENROUTER_API_KEY")).toBe("pi");
+    expect(deriveProviderFromKeyType("SOMETHING_ELSE")).toBe("claude");
   });
 });
 
@@ -266,4 +314,48 @@ describe("getModelAwareCredentialVars", () => {
     const vars = getModelAwareCredentialVars("opencode", "anthropic/claude-sonnet-4-20250514");
     expect(vars).not.toContain("OPENAI_API_KEY");
   });
+
+  it("routes nan/* and helmcode/* to their own key on pi and opencode", () => {
+    for (const provider of ["pi", "opencode"]) {
+      expect(getModelAwareCredentialVars(provider, "nan/glm5.3-flash")).toEqual(["NAN_API_KEY"]);
+      expect(getModelAwareCredentialVars(provider, "helmcode/glm5.3")).toEqual([
+        "HELMCODE_API_KEY",
+      ]);
+      // Only the exact prefix routes: a look-alike is any other provider/model.
+      const other = getModelAwareCredentialVars(provider, "other/x");
+      expect(getModelAwareCredentialVars(provider, "helmcodex/x")).toEqual(other);
+      expect(getModelAwareCredentialVars(provider, "nanx/y")).toEqual(other);
+      expect(other).not.toContain("NAN_API_KEY");
+      expect(other).not.toContain("HELMCODE_API_KEY");
+    }
+  });
+
+  it("keeps OpenRouter and bare-id routing byte-identical", () => {
+    for (const provider of ["pi", "opencode"]) {
+      expect(
+        getModelAwareCredentialVars(provider, "openrouter/deepseek/deepseek-v4-flash"),
+      ).toEqual(["OPENROUTER_API_KEY", "ANTHROPIC_API_KEY"]);
+      expect(getModelAwareCredentialVars(provider, "openai/gpt-5")).toEqual([
+        "OPENROUTER_API_KEY",
+        "ANTHROPIC_API_KEY",
+      ]);
+      expect(getModelAwareCredentialVars(provider, "gpt-4o")).toEqual([
+        "OPENROUTER_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "OPENAI_API_KEY",
+      ]);
+      // A NaN model routed through OpenRouter is still an OpenRouter model.
+      expect(getModelAwareCredentialVars(provider, "openrouter/nan/glm5.3")).toEqual([
+        "OPENROUTER_API_KEY",
+        "ANTHROPIC_API_KEY",
+      ]);
+    }
+  });
+
+  it("does not apply the nan/helmcode prefix routing to other harnesses", () => {
+    expect(getModelAwareCredentialVars("claude", "nan/glm5.3")).toEqual([
+      "CLAUDE_CODE_OAUTH_TOKEN",
+      "ANTHROPIC_API_KEY",
+    ]);
+  });
 });

package/src/utils/credentials.ts

@@ -1,4 +1,10 @@
 import { existsSync } from "node:fs";
+import {
+  openAICompatibleProviders,
+  providerForKeyVar,
+  providerForModel,
+  providerKeyVars,
+} from "@desplega/model-catalog";
 import { deriveDefaultRoute, routeCredentialStatus } from "@desplega/model-routing";
 import { type ModelFamily, modelFamilyOf, windowForModelFamily } from "./model-rate-limit-windows";
 
@@ -14,8 +20,27 @@ export const CREDENTIAL_POOL_VARS = [
   "AMP_API_KEY",
   "CURSOR_API_KEY",
   "XAI_API_KEY",
+  // The canonical key var of every OpenAI-compatible registry provider
+  // (`@desplega/model-catalog`). Aliases are normalized into these by the
+  // runner (`normalizeProviderKeyAliases`), so they never pool.
+  ...openAICompatibleProviders().map((p) => p.envVar),
 ] as const;
 
+/**
+ * Copy the first set alias of each registry provider into its canonical key
+ * var when the canonical var is empty (`HELMCODE_API_NAN` → `NAN_API_KEY`).
+ * The runner runs this once per task, so pooling, credential checks, pi's
+ * runtime key and the opencode key splice only read the canonical name. An
+ * explicit canonical value wins. Mutates `env`.
+ */
+export function normalizeProviderKeyAliases(env: Record<string, string | undefined>): void {
+  for (const provider of openAICompatibleProviders()) {
+    if (env[provider.envVar]?.trim()) continue;
+    const alias = provider.aliasEnvVars.find((name) => env[name]?.trim());
+    if (alias) env[provider.envVar] = env[alias];
+  }
+}
+
 /**
  * Which credential env vars are relevant for each harness provider. The
  * runner uses this map to filter `CREDENTIAL_POOL_VARS` so a codex worker
@@ -76,6 +101,10 @@ export function getModelAwareCredentialVars(provider: string, model?: string): r
     return model.startsWith("openrouter/") ? ["OPENROUTER_API_KEY"] : ["XAI_API_KEY"];
   }
   if (!SLASH_MODEL_PROVIDERS.has(provider) || !model) return base;
+  // OpenAI-compatible registry providers own their key: `nan/<id>` and
+  // `helmcode/<id>` never pool an OpenRouter or Anthropic key.
+  const direct = providerForModel(model);
+  if (direct) return [direct.envVar];
   if (model.includes("/")) {
     return base.filter((v) => v !== "OPENAI_API_KEY");
   }
@@ -91,6 +120,8 @@ export function getModelAwareCredentialVars(provider: string, model?: string): r
  * usage with the active worker's HARNESS_PROVIDER.
  */
 export function deriveProviderFromKeyType(keyType: string): string {
+  // OpenAI-compatible registry keys (canonical or alias) default to pi.
+  if (providerForKeyVar(keyType)) return "pi";
   switch (keyType) {
     case "CLAUDE_CODE_OAUTH_TOKEN":
     case "ANTHROPIC_API_KEY":
@@ -210,7 +241,7 @@ function isJsonObject(value: string): boolean {
  * Falls back to random selection from all credentials if no available indices match.
  * A JSON object value (the CODEX_OAUTH blob) is always one credential.
  */
-function splitCredentialPool(value: string): string[] {
+export function splitCredentialPool(value: string): string[] {
   return isJsonObject(value)
     ? [value.trim()]
     : value
@@ -311,21 +342,38 @@ export function validateClaudeCredentials(env: Record<string, string | undefined
   return CLAUDE_CREDENTIAL_TYPE_BY_PROVIDER[route.provider] ?? route.provider;
 }
 
+/**
+ * One label per OpenAI-compatible registry provider for hints and errors:
+ * `NAN_API_KEY (or HELMCODE_API_NAN)`, `HELMCODE_API_KEY`.
+ */
+export function openAICompatibleKeyLabels(): string[] {
+  return openAICompatibleProviders().map((p) =>
+    p.aliasEnvVars.length > 0 ? `${p.envVar} (or ${p.aliasEnvVars.join(" or ")})` : p.envVar,
+  );
+}
+
 /**
  * Validate that at least one opencode credential is available.
- * Priority: OPENROUTER_API_KEY → ANTHROPIC_API_KEY → OPENAI_API_KEY → ~/.local/share/opencode/auth.json.
+ * Priority: OPENROUTER_API_KEY → ANTHROPIC_API_KEY → OPENAI_API_KEY → each
+ * OpenAI-compatible registry provider's key (canonical or alias, e.g.
+ * NAN_API_KEY or HELMCODE_API_NAN → `nan_api_key`) →
+ * ~/.local/share/opencode/auth.json.
  * Returns the credential type found, or throws if none are available.
  */
 export function validateOpencodeCredentials(
   env: Record<string, string | undefined>,
-): "openrouter_api_key" | "anthropic_api_key" | "openai_api_key" | "auth_file" {
+): "openrouter_api_key" | "anthropic_api_key" | "openai_api_key" | Lowercase<string> | "auth_file" {
   if (env.OPENROUTER_API_KEY) return "openrouter_api_key";
   if (env.ANTHROPIC_API_KEY) return "anthropic_api_key";
   if (env.OPENAI_API_KEY) return "openai_api_key";
+  const direct = openAICompatibleProviders().find((p) => providerKeyVars(p).some((n) => env[n]));
+  if (direct) return direct.envVar.toLowerCase() as Lowercase<string>;
   const authFile = `${process.env.HOME ?? "/root"}/.local/share/opencode/auth.json`;
   if (existsSync(authFile)) return "auth_file";
   throw new Error(
-    "No opencode credentials found. Set OPENROUTER_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY, or provide ~/.local/share/opencode/auth.json.",
+    `No opencode credentials found. Set OPENROUTER_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY, ${openAICompatibleKeyLabels()
+      .map((label) => `${label}, `)
+      .join("")}or provide ~/.local/share/opencode/auth.json.`,
   );
 }
 

package/src/utils/harness-provider.ts

@@ -1,3 +1,4 @@
+import { openAICompatibleKeyVars } from "@desplega/model-catalog";
 import { type ProviderName, ProviderNameSchema } from "../types";
 
 const SUPPORTED_PROVIDERS = ProviderNameSchema.options;
@@ -10,23 +11,31 @@ function hasEnvValue(
   return !!(resolvedEnv[key]?.trim() || fallbackEnv[key]?.trim());
 }
 
+/**
+ * LLM keys that make "pi" the default harness when no Claude credential is
+ * set: OpenRouter plus every OpenAI-compatible registry key (canonical or alias).
+ */
+const PI_DEFAULT_KEY_VARS = ["OPENROUTER_API_KEY", ...openAICompatibleKeyVars()];
+
 /**
  * Credential-aware default for when HARNESS_PROVIDER is unset or invalid.
  * Unconditionally defaulting to "claude" leaves an OpenRouter-only swarm —
  * e.g. every auto-deployed swarm, which is provisioned with
  * OPENROUTER_API_KEY and NEVER an Anthropic credential — unable to
- * authenticate at all. Prefer "pi" when an OpenRouter key is present and no
- * Claude credential is; otherwise keep the original "claude" default.
+ * authenticate at all. Prefer "pi" when an OpenRouter key or an
+ * OpenAI-compatible registry key (NaN, Helmcode; canonical or alias) is
+ * present and no Claude credential is; otherwise keep the original "claude"
+ * default.
  */
 function credentialAwareDefault(
   resolvedEnv: Record<string, string | undefined>,
   fallbackEnv: Record<string, string | undefined>,
 ): ProviderName {
-  const hasOpenRouterKey = hasEnvValue("OPENROUTER_API_KEY", resolvedEnv, fallbackEnv);
+  const hasPiKey = PI_DEFAULT_KEY_VARS.some((key) => hasEnvValue(key, resolvedEnv, fallbackEnv));
   const hasClaudeCredential =
     hasEnvValue("ANTHROPIC_API_KEY", resolvedEnv, fallbackEnv) ||
     hasEnvValue("CLAUDE_CODE_OAUTH_TOKEN", resolvedEnv, fallbackEnv);
-  return hasOpenRouterKey && !hasClaudeCredential ? "pi" : "claude";
+  return hasPiKey && !hasClaudeCredential ? "pi" : "claude";
 }
 
 /**
@@ -36,8 +45,8 @@ function credentialAwareDefault(
  *   1. `resolvedEnv.HARNESS_PROVIDER` — value coming from `swarm_config`
  *      (overlay produced by `fetchResolvedEnv`, scoped repo > agent > global).
  *   2. `fallbackEnv.HARNESS_PROVIDER` — raw `process.env`.
- *   3. Credential-aware default — "pi" when an OpenRouter key is present and
- *      no Anthropic credential is (see `credentialAwareDefault`), else
+ *   3. Credential-aware default — "pi" when an OpenRouter or registry
+ *      provider key is present and no Anthropic credential is (see `credentialAwareDefault`), else
  *      `"claude"`.
  *
  * Invalid values (anything outside `ProviderNameSchema`) log a warning and

package/src/utils/runtime-model-catalog.ts

@@ -17,6 +17,7 @@
  * NO database imports (worker-safe). Every lookup is synchronous; the HTTP
  * refresh is TTL-cached and never throws, so hot paths stay cheap.
  */
+import { type CatalogChatRow, withRegistryCatalogSections } from "@desplega/model-catalog";
 import modelsDevSnapshot from "../be/modelsdev-cache.json";
 
 export interface RuntimeCatalogModel {
@@ -38,7 +39,16 @@ export interface RuntimeCatalogProvider {
 
 export type RuntimeCatalog = Record<string, RuntimeCatalogProvider | undefined>;
 
-const SNAPSHOT = modelsDevSnapshot as RuntimeCatalog;
+// Plus the registry-synthesized sections models.dev does not list (`helmcode`).
+const SNAPSHOT = withRegistryCatalogSections(modelsDevSnapshot as RuntimeCatalog);
+
+/**
+ * One section's full snapshot rows (output limit, modalities, tool calling),
+ * which the slim live catalog drops. Harness config blocks read these.
+ */
+export function snapshotCatalogRows(provider: string): Record<string, CatalogChatRow> {
+  return (SNAPSHOT[provider]?.models ?? {}) as Record<string, CatalogChatRow>;
+}
 
 /** Default freshness window for the worker-side HTTP pull. */
 export const RUNTIME_CATALOG_TTL_MS = 10 * 60_000;

package/src/utils/secret-scrubber.ts

@@ -21,6 +21,7 @@
  * API↔worker DB boundary (scripts/check-db-boundary.sh).
  */
 
+import { openAICompatibleKeyVars } from "@desplega/model-catalog";
 import { GITLEAKS_RULES } from "./secret-rules.generated";
 
 /**
@@ -35,9 +36,13 @@ import { GITLEAKS_RULES } from "./secret-rules.generated";
  * 5, the vendored gitleaks rule set, plus hand-written Resend, Google OAuth,
  * Discord webhook, xAI and bare Telegram shapes in pass 2; v6 = pass 5 resumes
  * after the secret, not the match, so adjacent secrets that share a delimiter
- * both redact, and sourcegraph-access-token drops its bare 40-hex branch.
+ * both redact, and sourcegraph-access-token drops its bare 40-hex branch;
+ * v7 = the OpenAI-compatible registry key vars (`NAN_API_KEY`,
+ * `HELMCODE_API_KEY`, and the `HELMCODE_API_NAN` alias no suffix matches).
+ * A new registry entry adds key vars, so it is a rule change too
+ * (`secret-scrubber.test.ts` pins the list to this number).
  */
-export const SCRUBBER_RULES_VERSION = 6;
+export const SCRUBBER_RULES_VERSION = 8;
 
 /** Env-var names that are always considered secrets, even without suffix hints. */
 const SENSITIVE_KEY_EXACT = new Set<string>([
@@ -52,6 +57,9 @@ const SENSITIVE_KEY_EXACT = new Set<string>([
   "ANTHROPIC_API_KEY",
   "OPENAI_API_KEY",
   "OPENROUTER_API_KEY",
+  // OpenAI-compatible registry key vars, canonical and alias. An alias such
+  // as `HELMCODE_API_NAN` matches no SENSITIVE_KEY_SUFFIXES entry.
+  ...openAICompatibleKeyVars(),
   "SLACK_BOT_TOKEN",
   "SLACK_SIGNING_SECRET",
   "SLACK_CLIENT_SECRET",
@@ -800,6 +808,21 @@ function computeIsSensitiveKey(key: string): boolean {
   return false;
 }
 
+/**
+ * Every form of a credential value a consumer may send: the raw value, its
+ * trimmed form, and each trimmed member of a comma pool. `selectCredential`
+ * trims the key it hands out, so a padded singleton reaches the provider (and
+ * its error echo) without the padding.
+ */
+function credentialCandidates(value: string): string[] {
+  const candidates = new Set([value, value.trim()]);
+  if (value.includes(",")) {
+    for (const member of value.split(",")) candidates.add(member.trim());
+  }
+  candidates.delete("");
+  return [...candidates];
+}
+
 function buildCache(): ScrubCache {
   const entries: EnvValueEntry[] = [];
   const seen = new Set<string>();
@@ -808,14 +831,7 @@ function buildCache(): ScrubCache {
     if (!rawValue) continue;
     if (!isSensitiveKey(key)) continue;
 
-    // Credential pools: a single env var may hold a comma-separated list of
-    // tokens that the runner rotates through. Scrub each component too.
-    const candidates = rawValue.includes(",")
-      ? [rawValue, ...rawValue.split(",").map((s) => s.trim())]
-      : [rawValue];
-
-    for (const candidate of candidates) {
-      if (!candidate) continue;
+    for (const candidate of credentialCandidates(rawValue)) {
       if (candidate.length < MIN_VALUE_LENGTH) continue;
       for (const form of escapedForms(candidate)) {
         if (seen.has(form)) continue;
@@ -1005,6 +1021,52 @@ export function scrubObject<T>(value: T, seen = new WeakSet<object>()): T {
   return out as T;
 }
 
+export type ValueScrubber = {
+  text(text: string): string;
+  object<T>(value: T): T;
+};
+
+/**
+ * Redact exact occurrences of the given values, at any length, in one output
+ * boundary that knows which secrets it handed out (a script run's secret
+ * config). The global passes above keep their MIN_VALUE_LENGTH floor; this
+ * one never registers anything swarm-wide. All forms match in a single regex
+ * pass, longest first, so one value's marker is never rewritten by another
+ * value's pass. Object keys are redacted too.
+ */
+export function createValueScrubber(
+  entries: Array<{ value: string; name: string }>,
+): ValueScrubber {
+  const names = new Map<string, string>();
+  for (const { value, name } of entries) {
+    if (!value) continue;
+    for (const form of escapedForms(value)) if (!names.has(form)) names.set(form, name);
+  }
+  if (names.size === 0) return { text: (text) => text, object: (value) => value };
+
+  const pattern = [...names.keys()]
+    .sort((a, b) => b.length - a.length)
+    .map(escapeRegExp)
+    .join("|");
+  const re = new RegExp(pattern, "g");
+  const text = (input: string) =>
+    input.replace(re, (match) => `[REDACTED:${names.get(match) ?? "secret"}]`);
+  const object = <T>(value: T, seen = new WeakSet<object>()): T => {
+    if (typeof value === "string") return text(value) as T;
+    if (value === null || typeof value !== "object") return value;
+    if (seen.has(value)) return "[Circular]" as T;
+    seen.add(value);
+    if (Array.isArray(value)) return value.map((item) => object(item, seen)) as T;
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>).map(([key, child]) => [
+        text(key),
+        object(child, seen),
+      ]),
+    ) as T;
+  };
+  return { text, object: (value) => object(value) };
+}
+
 /**
  * Force the env-value cache to rebuild on the next scrub call. Callers should
  * invoke this whenever the swarm_config is reloaded (`/internal/reload-config`
@@ -1031,6 +1093,20 @@ export function registerVolatileSecret(value: string, name: string): void {
   }
 }
 
+/**
+ * Register the sensitive values of an env map that is not `process.env`
+ * (a runner's per-task env, an adapter's session env). A key picked from a
+ * credential pool, or a row admitted after boot, lives only there, so the
+ * env pass never sees it. Comma-separated pools register each member too,
+ * and padded values register their trimmed form.
+ */
+export function registerEnvSecrets(env: Record<string, string | undefined>): void {
+  for (const [key, value] of Object.entries(env)) {
+    if (!value || !isSensitiveKey(key)) continue;
+    for (const candidate of credentialCandidates(value)) registerVolatileSecret(candidate, key);
+  }
+}
+
 /** Remove a short-lived secret and its encoded forms after credential revocation. */
 export function unregisterVolatileSecret(name: string): void {
   for (const [value, registeredName] of volatileSecrets) {

package/src/utils/task-tool-manifest.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { chatThreadOfContextKey } from "../tasks/context-key";
 import { ALL_TOOLS } from "../tools/tool-config";
 
 const toolNames = z
@@ -15,9 +16,22 @@ export function parseTaskToolManifest(value: string) {
   return taskToolManifestSchema.parse(JSON.parse(value));
 }
 
+/** Tools that act on the chat thread of the calling task; useless on any other task. */
+export const CHAT_TASK_ONLY_TOOLS: readonly string[] = ["chat-reply"];
+
+/** True when the task came from a Chat SDK thread (contextKey family `chat-sdk`). */
+export function isChatSdkTask(task: { contextKey?: string | null }): boolean {
+  return chatThreadOfContextKey(task.contextKey) !== null;
+}
+
 export function selectTaskTools(
   manifest: z.infer<typeof taskToolManifestSchema>,
-  task: { taskType?: string; scheduleId?: string; slackChannelId?: string },
+  task: {
+    taskType?: string;
+    scheduleId?: string;
+    slackChannelId?: string;
+    contextKey?: string | null;
+  },
 ): string[] {
   const fromSchedule =
     task.scheduleId && Object.hasOwn(manifest.schedules ?? {}, task.scheduleId)
@@ -27,7 +41,10 @@ export function selectTaskTools(
     task.taskType && Object.hasOwn(manifest.taskTypes ?? {}, task.taskType)
       ? manifest.taskTypes?.[task.taskType]
       : undefined;
+  const chatTask = isChatSdkTask(task);
   return [...new Set(fromSchedule ?? fromType ?? [])].filter(
-    (name) => !name.startsWith("slack-") || Boolean(task.slackChannelId),
+    (name) =>
+      (!name.startsWith("slack-") || Boolean(task.slackChannelId)) &&
+      (chatTask || !CHAT_TASK_ONLY_TOOLS.includes(name)),
   );
 }

package/src/utils/vcs-repo-match.ts

@@ -0,0 +1,29 @@
+/**
+ * How a task's `vcsRepo` names a registered repo (`swarm_repos`). The worker
+ * loads that repo's scoped config with it (`fetchRepoConfig`), and the API
+ * reads the same repo at claim, so both sides must match the same way.
+ */
+
+/** `vcsRepo` without surrounding spaces, trailing slashes or `.git`. */
+export function normalizeVcsRepo(vcsRepo: string): string {
+  return vcsRepo
+    .trim()
+    .replace(/\/+$/, "")
+    .replace(/\.git$/, "");
+}
+
+/** The `swarm_repos.name` candidates are looked up by: the last path segment. */
+export function vcsRepoName(vcsRepo: string): string {
+  const requested = normalizeVcsRepo(vcsRepo);
+  return requested.split("/").pop() || requested;
+}
+
+/** Whether a registered repo URL is exactly the repo `vcsRepo` names. */
+export function vcsRepoUrlMatches(url: string, vcsRepo: string): boolean {
+  const requested = normalizeVcsRepo(vcsRepo);
+  const normalized = normalizeVcsRepo(url);
+  if (normalized === requested) return true;
+  // Qualified URLs must retain their host. Only shorthand references use suffix matching.
+  if (requested.includes(":")) return false;
+  return normalized.endsWith(`/${requested}`) || normalized.endsWith(`:${requested}`);
+}

package/src/workflows/executors/raw-llm.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import type { ExecutorMeta } from "../../types";
+import { scrubSecrets } from "../../utils/secret-scrubber";
 import { BaseExecutor, type ExecutorResult } from "./base";
 import { resolveWorkflowLlmConfig } from "./workflow-llm";
 
@@ -72,7 +73,7 @@ export async function executeRawLlm(
     const isRateLimited =
       httpStatus === 429 ||
       httpStatus === 529 ||
-      (err instanceof Error && /rate.?limit|too many requests|529/i.test(err.message));
+      (err instanceof Error && /rate.?limit|too many requests|\b529\b/i.test(err.message));
     if (isRateLimited) {
       throw err;
     }
@@ -80,12 +81,16 @@ export async function executeRawLlm(
       return {
         status: "success",
         output: { result: null, model: modelName },
-        error: `LLM call failed, using fallback port: ${err instanceof Error ? err.message : String(err)}`,
+        error: scrubSecrets(
+          `LLM call failed, using fallback port: ${err instanceof Error ? err.message : String(err)}`,
+        ),
       };
     }
     return {
       status: "failed",
-      error: `LLM call failed: ${err instanceof Error ? err.message : String(err)}`,
+      // Provider errors can echo the request key back; scrub before any
+      // consumer (journal, HTTP route, workflow step) sees the text.
+      error: scrubSecrets(`LLM call failed: ${err instanceof Error ? err.message : String(err)}`),
     };
   }
 }

package/src/workflows/executors/swarm-script.ts

@@ -127,6 +127,7 @@ export class SwarmScriptExecutor extends BaseExecutor<
       mcpBaseUrl: getMcpBaseUrl(),
       egressSecrets: credentials.egressSecrets,
       failedBindings: credentials.failedBindings,
+      userConfig: credentials.userConfig,
       apiConnections: getScriptApiConnectionDescriptors({ agentId: agentId ?? undefined }),
       mcpConnections: getScriptMcpConnectionDescriptors({ agentId: agentId ?? undefined }),
       timeoutMs: config.timeoutMs,