@desplega.ai/agent-swarm 1.173.0 → 2.1.0

package/src/commands/runner.ts

@@ -11,7 +11,14 @@ import {
   withSpan,
   withSpanContext,
 } from "../otel.ts";
-import { type BasePromptArgs, getBasePrompt } from "../prompts/base-prompt.ts";
+import {
+  type BasePromptArgs,
+  getBasePrompt,
+  getTaskContextPrompt,
+  type RepoContext,
+  type SlackTaskContext,
+  type TaskContextPromptArgs,
+} from "../prompts/base-prompt.ts";
 import {
   generateDefaultClaudeMd,
   generateDefaultIdentityMd,
@@ -40,6 +47,7 @@ import {
   type ProviderSession,
   type ProviderSessionConfig,
 } from "../providers/index.ts";
+import { effectiveReasoningEffort } from "../providers/reasoning-effort.ts";
 import {
   createSkillInvokeTracker,
   isSkillLoaderCall,
@@ -48,6 +56,7 @@ import {
 } from "../providers/skill-invoke.ts";
 import type { SteerDeliveryResult } from "../providers/types.ts";
 import { WorkerRealtimeClient } from "../realtime/worker-client";
+import { resumedTaskModelSelection, type TaskModelPinFields } from "../tasks/model-pin.ts";
 import { initTelemetry, telemetry } from "../telemetry.ts";
 import { mapTriggerSurface } from "../telemetry-context.ts";
 import {
@@ -66,12 +75,14 @@ import { getApiKey } from "../utils/api-key.ts";
 import { computeBudgetBackoffMs } from "../utils/budget-backoff.ts";
 import { ensure, initialize } from "../utils/business-use";
 import { isCodexAuthFailureReason } from "../utils/codex-auth-failure.ts";
+import { isEnvExportRestrictedKey } from "../utils/config-env-export.ts";
 import { MASKED_SECRET_VALUE } from "../utils/config-secrets.ts";
 import { getMcpBaseUrl } from "../utils/constants.ts";
 import { getContextWindowSize } from "../utils/context-window.ts";
 import {
   type CredentialSelection,
   ModelWindowExhaustedError,
+  normalizeProviderKeyAliases,
   resolveCredentialPools,
 } from "../utils/credentials.ts";
 import { resolveCodexCreditsExhaustedCooldownMs } from "../utils/error-tracker.ts";
@@ -81,11 +92,16 @@ import { prettyPrintLine, prettyPrintStderr } from "../utils/pretty-print.ts";
 import { terminateRegisteredProcessGroups } from "../utils/process-group.ts";
 import { refreshRuntimeModelCatalog } from "../utils/runtime-model-catalog.ts";
 import { resolveScriptsOnlyMode } from "../utils/scripts-only-mode.ts";
-import { registerSensitiveKeyName, scrubSecrets } from "../utils/secret-scrubber.ts";
+import {
+  registerEnvSecrets,
+  registerSensitiveKeyName,
+  scrubSecrets,
+} from "../utils/secret-scrubber.ts";
 import { refreshSkillsIfChanged } from "../utils/skills-refresh.ts";
 import { guardSpawnModel } from "../utils/spawn-model-guard.ts";
 import { isSteeringEnabled } from "../utils/steering-enabled.ts";
 import { interpolate } from "../utils/template.ts";
+import { vcsRepoName, vcsRepoUrlMatches } from "../utils/vcs-repo-match.ts";
 import {
   canonicalAzureDevOpsRepoUrl,
   isAzureDevOpsUrl,
@@ -181,17 +197,6 @@ function scheduleRunnerGc(reason: string): boolean {
   return true;
 }
 
-/** Save PM2 process list for persistence across container restarts */
-async function savePm2State(role: string): Promise<void> {
-  try {
-    console.log(`[${role}] Saving PM2 process list...`);
-    await Bun.$`pm2 save`.quiet();
-    console.log(`[${role}] PM2 state saved`);
-  } catch {
-    // PM2 not available or no processes - silently ignore
-  }
-}
-
 /** Fetch repo config for a task's vcsRepo (e.g., "desplega-ai/agent-swarm") */
 export async function fetchRepoConfig(
   apiUrl: string,
@@ -208,11 +213,7 @@ export async function fetchRepoConfig(
   guidelines?: RepoGuidelines | null;
 } | null> {
   try {
-    const requested = vcsRepo
-      .trim()
-      .replace(/\/+$/, "")
-      .replace(/\.git$/, "");
-    const repoName = requested.split("/").pop() || requested;
+    const repoName = vcsRepoName(vcsRepo);
     const resp = await fetch(`${apiUrl}/api/repos?name=${encodeURIComponent(repoName)}`, {
       headers: { Authorization: `Bearer ${apiKey}` },
     });
@@ -229,18 +230,7 @@ export async function fetchRepoConfig(
       }>;
     };
     if (requireExactMatch) {
-      return (
-        data.repos.find((r) => {
-          const normalized = r.url
-            .trim()
-            .replace(/\/+$/, "")
-            .replace(/\.git$/, "");
-          if (normalized === requested) return true;
-          // Qualified URLs must retain their host. Only shorthand references use suffix matching.
-          if (requested.includes(":")) return false;
-          return normalized.endsWith(`/${requested}`) || normalized.endsWith(`:${requested}`);
-        }) ?? null
-      );
+      return data.repos.find((r) => vcsRepoUrlMatches(r.url, vcsRepo)) ?? null;
     }
     return data.repos.find((r) => r.url.includes(vcsRepo)) ?? data.repos[0] ?? null;
   } catch {
@@ -846,6 +836,19 @@ const deploymentMemoryRaters = process.env.MEMORY_RATERS;
  */
 const rowOverriddenBootEnv = new Map<string, string | undefined>();
 
+let lastWithheldEnvKeys = "";
+
+/** Names only, and only when the set changes, so per-spawn reloads stay quiet. */
+function logWithheldEnvKeys(keys: string[]): void {
+  const summary = [...keys].sort().join(", ");
+  if (summary === lastWithheldEnvKeys) return;
+  lastWithheldEnvKeys = summary;
+  if (!summary) return;
+  console.log(
+    `[env-reload] Kept ${keys.length} config entries with exportToEnv=false out of the harness env: ${summary}`,
+  );
+}
+
 export async function fetchResolvedEnv(
   apiUrl: string,
   apiKey: string,
@@ -895,7 +898,12 @@ export async function fetchResolvedEnv(
         console.warn(`[env-reload] Failed to fetch config: ${response.status}`);
       } else {
         const data = (await response.json()) as {
-          configs: Array<{ key: string; value: string; isSecret?: boolean }>;
+          configs: Array<{
+            key: string;
+            value: string;
+            isSecret?: boolean;
+            exportToEnv?: boolean;
+          }>;
         };
 
         // A deleted row restores the deployment value (including unset), while
@@ -914,7 +922,25 @@ export async function fetchResolvedEnv(
           scriptsOnlyConfigValue = data.configs.find(
             (config) => config.key === "SCRIPTS_ONLY_MCP",
           )?.value;
+          const withheldEnvKeys: string[] = [];
           for (const config of data.configs) {
+            // Every harness and its shell tool inherit this env. A row with
+            // exportToEnv=false stays out of it, and so does a copy of it in
+            // the base env (container env, or an older entrypoint's export).
+            // Checked before the masked-value fallback so a masked response
+            // can never keep a withheld boot value alive. An API without the
+            // field (pre-215) leaves it undefined, which keeps exporting.
+            if (config.exportToEnv === false || isEnvExportRestrictedKey(config.key)) {
+              if (config.isSecret) registerSensitiveKeyName(config.key);
+              delete env[config.key];
+              // Several adapters build the child env as
+              // `{ ...process.env, ...config.env }`, so a boot-time export
+              // revoked later must leave process.env too. It stays out until
+              // the worker restarts, even if the row is deleted afterwards.
+              if (baseEnv === process.env) delete process.env[config.key];
+              withheldEnvKeys.push(config.key);
+              continue;
+            }
             if (config.isSecret && config.value === MASKED_SECRET_VALUE) {
               skippedSecretKeys.push(config.key);
               continue;
@@ -957,6 +983,7 @@ export async function fetchResolvedEnv(
               scrubSecrets(`[env-reload] Skipped masked secrets: ${skippedSecretKeys.join(", ")}`),
             );
           }
+          logWithheldEnvKeys(withheldEnvKeys);
           console.log(`[env-reload] Loaded ${data.configs.length} config entries from API`);
         }
         // Non-secret stand-in for the pool rows skipped above, so credential
@@ -969,6 +996,16 @@ export async function fetchResolvedEnv(
     }
   }
 
+  // Registry key aliases (`HELMCODE_API_NAN` for `NAN_API_KEY`) are copied
+  // into their canonical var once here, so pooling, credential checks, pi's
+  // runtime key and the opencode key splice only ever read the canonical
+  // name. An explicit canonical value wins.
+  normalizeProviderKeyAliases(env);
+  // Rows admitted after boot and pool members live only in this env, never in
+  // process.env, so the scrubber's env pass cannot see them. Register them
+  // before any adapter can echo one into a log or failure reason.
+  registerEnvSecrets(env);
+
   // A task already has an adapter. Repository configuration must not select
   // credentials or configure hooks for a different harness.
   const resolvedProvider = sessionContext?.provider ?? resolveHarnessProvider(env, baseEnv);
@@ -1355,11 +1392,6 @@ const SWARM_TOOL_LABELS: Record<string, string | null> = {
   "create-channel": "📢 Creating channel",
   "list-channels": "📢 Listing channels",
   "delete-channel": "📢 Deleting channel",
-  // Services
-  "register-service": "🔌 Registering service",
-  "list-services": "🔌 Listing services",
-  "unregister-service": "🔌 Unregistering service",
-  "update-service-status": "🔌 Updating service status",
   // Reusable scripts
   "script-search": "📜 Searching scripts",
   "script-run": "📜 Running script",
@@ -2343,6 +2375,7 @@ export async function getPausedTasksFromAPI(config: ApiConfig): Promise<
     output?: string;
     status?: string;
     contextKey?: string;
+    requestedBy?: Trigger["requestedBy"];
   }>
 > {
   const headers: Record<string, string> = {
@@ -2379,6 +2412,7 @@ export async function getPausedTasksFromAPI(config: ApiConfig): Promise<
         finishedAt?: string;
         output?: string;
         status?: string;
+        requestedBy?: Trigger["requestedBy"];
       }>;
     };
     return data.tasks || [];
@@ -2537,7 +2571,6 @@ export function setupShutdownHandlers(
       });
       await closeAgent(apiConfig, role);
     }
-    await savePm2State(role);
     process.exit(exitCode);
   };
 
@@ -2805,10 +2838,13 @@ async function saveProviderSessionId(
   model?: string,
   harnessVariant?: string,
   harnessVariantMeta?: Record<string, unknown>,
+  effort?: ReasoningEffort | null,
 ): Promise<void> {
   const headers: Record<string, string> = { "Content-Type": "application/json" };
   if (apiKey) headers.Authorization = `Bearer ${apiKey}`;
   const body: Record<string, unknown> = { claudeSessionId };
+  // Devin's body variant has no effort field.
+  if (effort !== undefined && provider !== "devin") body.effort = effort;
   if (provider !== undefined) body.provider = provider;
   if (providerMeta !== undefined) body.providerMeta = providerMeta;
   if (model !== undefined && model !== "") body.model = model;
@@ -3284,6 +3320,64 @@ export async function buildRequesterProfilePrompt(
   return result.skipped ? "" : result.text.trim();
 }
 
+/**
+ * Warning appended to the task prompt when the task's `dir` was requested but
+ * the session could not start there. Shared by the fresh and resume paths so
+ * both send the model the same text.
+ */
+export function missingTaskDirWarning(
+  taskDir: string | undefined,
+  effectiveCwd: string | undefined,
+): string | undefined {
+  return taskDir && !effectiveCwd
+    ? `Note: The task requested working directory "${taskDir}" but it does not exist. Falling back to default directory.`
+    : undefined;
+}
+
+/** Per-task context that rides in the task prompt, never the system prompt. */
+export type TaskSessionContext = Omit<TaskContextPromptArgs, keyof BasePromptArgs> & {
+  requestedBy?: RequesterProfile;
+  /** Set when the task's `dir` does not exist and the session falls back. */
+  cwdWarning?: string;
+};
+
+/**
+ * The two prompts of one task session. The system prompt depends only on the
+ * agent (profile, harness, deployment), so it is byte-identical across that
+ * agent's sessions and the provider reads it from cache instead of re-writing
+ * it. Everything that varies per task (repository block, scripts-only Slack
+ * note, requester profile, cwd warning) is appended to the task prompt.
+ */
+export async function buildTaskSessionPrompts(input: {
+  basePromptArgs: BasePromptArgs;
+  additionalSystemPrompt?: string;
+  taskPrompt: string;
+  context: TaskSessionContext;
+}): Promise<{ systemPrompt: string; prompt: string }> {
+  const { basePromptArgs, additionalSystemPrompt, context } = input;
+  const basePrompt = await getBasePrompt(basePromptArgs);
+  const systemPrompt = additionalSystemPrompt
+    ? `${basePrompt}\n\n${additionalSystemPrompt}`
+    : basePrompt;
+
+  const taskContext = [
+    await getTaskContextPrompt({
+      ...basePromptArgs,
+      repoContext: context.repoContext,
+      slackContext: context.slackContext,
+    }),
+    await buildRequesterProfilePrompt(context.requestedBy),
+    context.cwdWarning?.trim(),
+  ]
+    .filter((part): part is string => Boolean(part))
+    .join("\n\n");
+
+  return {
+    systemPrompt,
+    prompt: taskContext ? `${input.taskPrompt}\n\n${taskContext}` : input.taskPrompt,
+  };
+}
+
 /** A non-2xx answer from `POST /api/agents`; carries the status for retry triage. */
 export class AgentRegistrationHttpError extends Error {
   readonly status: number;
@@ -4128,6 +4222,9 @@ async function spawnProviderProcess(
   }
   if (spawnModel.warning) console.warn(spawnModel.warning);
   const model = spawnModel.model;
+  // Recorded on the task at session start, like the model: what the adapter
+  // applies, not just what was asked for.
+  const sessionEffort = effectiveReasoningEffort(adapter.name, model, reasoningEffortOverride);
 
   // Resolve Codex OAuth pool slot BEFORE building ProviderSessionConfig so we
   // can pass codexSlot through and the adapter writes token refreshes back to
@@ -4431,6 +4528,7 @@ async function spawnProviderProcess(
               model,
               event.harnessVariant,
               event.harnessVariantMeta,
+              sessionEffort,
             ).catch((err) => console.warn(`[runner] Failed to save session ID: ${err}`));
           } else {
             // Pool task: save provider session ID on active session so it can be
@@ -5690,17 +5788,13 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
   let agentSkillsSummary: { name: string; description: string }[] | undefined;
   let agentMcpServers: string[] | undefined;
 
-  // Per-task repo context — set when processing a task with githubRepo
-  let currentRepoContext: BasePromptArgs["repoContext"] | undefined;
-  // Slack context for current task (gates Slack instructions in prompt)
-  let currentTaskSlackContext: BasePromptArgs["slackContext"] | undefined;
-
   // Generate base prompt (identity fields injected after profile fetch below).
   // Traits are read fresh on each call so a live adapter swap (Section 4)
-  // produces a prompt matching the new provider's capabilities.
-  const buildSystemPrompt = async () => {
+  // produces a prompt matching the new provider's capabilities. Per-task
+  // context never enters it; see buildTaskSessionPrompts.
+  const basePromptArgs = (): BasePromptArgs => {
     const { traits } = adapter;
-    return getBasePrompt({
+    return {
       role,
       agentId,
       capabilities,
@@ -5711,20 +5805,19 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
       name: agentProfileName,
       description: agentDescription,
       // SOUL.md is the persona and travels to every provider. base-prompt
-      // gates IDENTITY.md (inject when edited) and CLAUDE.md (local
-      // non-claude providers, inject when edited) itself.
+      // gates IDENTITY.md and CLAUDE.md (inject when edited) itself.
       soulMd: agentSoulMd,
       identityMd: agentIdentityMd,
       claudeMd: agentClaudeMd,
-      repoContext: currentRepoContext,
-      slackContext: currentTaskSlackContext,
       ...(traits.hasMcp && {
         skillsSummary: agentSkillsSummary,
         mcpServers: agentMcpServers,
       }),
-    });
+    };
   };
 
+  const buildSystemPrompt = async () => getBasePrompt(basePromptArgs());
+
   let basePrompt = await buildSystemPrompt();
 
   // Resolve additional system prompt: CLI flag > env var
@@ -6657,7 +6750,8 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
           }
         }
 
-        if (!resumeCwd && task.vcsRepo && apiUrl) {
+        let resumeRepoContext: RepoContext | undefined;
+        if (task.vcsRepo && apiUrl) {
           const repoConfig = await fetchRepoConfig(apiUrl, apiKey, task.vcsRepo);
           const effectiveConfig = repoConfig ?? {
             url: task.vcsRepo,
@@ -6668,11 +6762,34 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
           // This is the paused-task-resume-after-restart path — never a first
           // kickoff, so never force-reset the base branch here.
           const repoContext = await ensureRepoForTask(effectiveConfig, role, false);
-          if (repoContext?.clonePath) {
+          resumeRepoContext = { ...repoContext, guidelines: repoConfig?.guidelines ?? null };
+          if (!resumeCwd && repoContext?.clonePath) {
             resumeCwd = repoContext.clonePath;
           }
         }
 
+        // Same split as the main task path: stable system prompt, per-task
+        // context (repository, scripts-only Slack note, requester profile,
+        // cwd warning) in the task prompt.
+        const resumeSlackChannelId = (task as { slackChannelId?: string }).slackChannelId;
+        const resumeSession = await buildTaskSessionPrompts({
+          basePromptArgs: basePromptArgs(),
+          additionalSystemPrompt,
+          taskPrompt: resumePrompt,
+          context: {
+            repoContext: resumeRepoContext,
+            slackContext: resumeSlackChannelId
+              ? {
+                  channelId: resumeSlackChannelId,
+                  threadTs: (task as { slackThreadTs?: string }).slackThreadTs,
+                }
+              : undefined,
+            requestedBy: task.requestedBy,
+            cwdWarning: missingTaskDirWarning(task.dir, resumeCwd),
+          },
+        });
+        resumePrompt = resumeSession.prompt;
+
         // Per-task runner session ID so session logs are scoped to this task
         const resumeRunnerSessionId = crypto.randomUUID();
 
@@ -6693,7 +6810,7 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
             {
               prompt: resumePrompt,
               logFile,
-              systemPrompt: resolvedSystemPrompt,
+              systemPrompt: resumeSession.systemPrompt,
               additionalArgs: opts.additionalArgs,
               // Native resume deprecated: always undefined. Follow-up continuity flows through
               // the context preamble injected above (see context-preamble.ts).
@@ -6706,10 +6823,11 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
               runnerSessionId: resumeRunnerSessionId,
               iteration,
               taskId: task.id,
-              model: (task as { model?: string }).model,
+              // Only the task's own pin carries over. `model` and the claim
+              // record describe the run before the pause; without a pin the
+              // resumed run resolves from the agent's current config.
+              ...resumedTaskModelSelection(task as TaskModelPinFields),
               modelTier: (task as { modelTier?: string }).modelTier,
-              resolvedModel: (task as { resolvedModel?: string }).resolvedModel,
-              modelSource: (task as { modelSource?: string }).modelSource,
               effort: (task as { effort?: ReasoningEffort }).effort,
               harnessProvider: state.harnessProvider,
               cwd: resumeCwd,
@@ -7102,11 +7220,12 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
           ?.slackChannelId;
         const taskSlackThreadTs = (trigger.task as { slackThreadTs?: string } | undefined)
           ?.slackThreadTs;
-        currentTaskSlackContext = taskSlackChannelId
+        const taskSlackContext: SlackTaskContext | undefined = taskSlackChannelId
           ? { channelId: taskSlackChannelId, threadTs: taskSlackThreadTs }
           : undefined;
 
         // Handle repo context for tasks with vcsRepo (GitHub/GitLab)
+        let currentRepoContext: RepoContext | undefined;
         const taskVcsRepo = (trigger.task as { vcsRepo?: string } | undefined)?.vcsRepo;
         if (taskVcsRepo && apiUrl) {
           const repoConfig = await fetchRepoConfig(apiUrl, apiKey, taskVcsRepo);
@@ -7130,8 +7249,6 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
             ...repoResult,
             guidelines: repoConfig?.guidelines ?? null,
           };
-        } else {
-          currentRepoContext = undefined;
         }
 
         // Resolve effective working directory (priority: task.dir > repoContext.clonePath > process.cwd())
@@ -7170,11 +7287,8 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
             " You can still access any path on the filesystem — this is just your starting directory.";
         }
 
-        // Warn in system prompt when task dir was specified but doesn't exist
-        let cwdWarning = "";
-        if (taskDir && !effectiveCwd) {
-          cwdWarning = `\n\nNote: The task requested working directory "${taskDir}" but it does not exist. Falling back to default directory.`;
-        }
+        // Warn when task dir was specified but doesn't exist
+        const cwdWarning = missingTaskDirWarning(taskDir, effectiveCwd);
 
         // Per-task skill hot-reload. Reuses the boot-time helper; signature
         // probe short-circuits when nothing changed. Skipped for
@@ -7220,13 +7334,21 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
           );
         }
 
-        // Rebuild system prompt with per-task repo context
-        const taskBasePrompt = await buildSystemPrompt();
-        const requesterProfilePrompt = await buildRequesterProfilePrompt(trigger.requestedBy);
-        const taskPromptParts = [taskBasePrompt, requesterProfilePrompt, additionalSystemPrompt]
-          .filter((part): part is string => Boolean(part))
-          .join("\n\n");
-        const taskSystemPrompt = taskPromptParts + cwdWarning;
+        // Rebuild the system prompt (profile or skills may have changed) and
+        // append the per-task context to the task prompt.
+        const taskSession = await buildTaskSessionPrompts({
+          basePromptArgs: basePromptArgs(),
+          additionalSystemPrompt,
+          taskPrompt: triggerPrompt,
+          context: {
+            repoContext: currentRepoContext,
+            slackContext: taskSlackContext,
+            requestedBy: trigger.requestedBy,
+            cwdWarning,
+          },
+        });
+        const taskSystemPrompt = taskSession.systemPrompt;
+        triggerPrompt = taskSession.prompt;
 
         // The server refused the task's explicit model for this worker's CLI
         // version (harness_model_support = unsupported): fail fast, no spawn.

package/src/e2b/env.ts

@@ -1,4 +1,5 @@
 import { resolve } from "node:path";
+import { openAICompatibleBaseUrlVars, openAICompatibleKeyVars } from "@desplega/model-catalog";
 import { getApiKey } from "../utils/api-key";
 import { isSensitiveKey, scrubSecrets } from "../utils/secret-scrubber";
 
@@ -20,6 +21,10 @@ export const DEFAULT_E2B_FORWARD_KEYS = [
   "CLAUDE_CODE_OAUTH_TOKEN",
   "OPENAI_API_KEY",
   "OPENROUTER_API_KEY",
+  // OpenAI-compatible registry providers: key vars (canonical and alias) and
+  // their `<ID>_BASE_URL` overrides.
+  ...openAICompatibleKeyVars(),
+  ...openAICompatibleBaseUrlVars(),
   "GITHUB_TOKEN",
   "GITLAB_TOKEN",
   "AZURE_DEVOPS_TOKEN",

package/src/extensions/catalog.generated.json

@@ -1,4 +1,21 @@
 {
+  "comms-adherence-gate": {
+    "manifestFile": "manifest.json",
+    "manifest": {
+      "$schema": "../manifest.schema.json",
+      "name": "comms-adherence-gate",
+      "description": "Judges every Slack-facing store-progress completion against the requester's comms preferences and latest request with Jev (TypeSafe or OpenRouter), and in enforce blocks a non-adherent completion once per task",
+      "version": "1.5.0",
+      "runtime": "api",
+      "assets": {
+        "hooks": "hooks.ts"
+      }
+    },
+    "files": {
+      "hooks.ts": "import { type ApiCtx, block, type SwarmExtension } from \"swarm-extension\";\nimport { z } from \"zod\";\n\n/**\n * comms-adherence-gate\n *\n * When an agent calls `store-progress` with status \"completed\" on a task that\n * reaches a human in Slack, judge the `output` against the requesting user's\n * stored comms preferences (users.metadata.$.comms) with Jev, and against what\n * that user actually asked for in their latest message. An explicit request\n * (\"tell me a long joke\", \"explain in detail\") outranks the stored default, so\n * a requested long answer is not a verbosity failure.\n *\n * Transport (config.provider): Jev is served by TypeSafe directly and by\n * OpenRouter's Decisions endpoint. Both take the same {model, state, questions}\n * body and return the same `answers` shape. `auto` uses TYPESAFE_API_KEY when\n * set, else OPENROUTER_API_KEY.\n *\n * modes (config.mode):\n *   off     -> never evaluate\n *   shadow  -> evaluate + record, never block (default)\n *   enforce -> record, and block the completion up to maxBlocksPerTask times\n *              per task with actionable feedback\n *\n * Fails OPEN on every error: a judge outage must never wall the swarm.\n * Every verdict lands in KV namespace `ext:comms-gate`.\n */\n\nexport const config = z.object({\n  mode: z.enum([\"off\", \"shadow\", \"enforce\"]).default(\"shadow\"),\n  /** A dimension scoring below this fails. */\n  threshold: z.number().min(0).max(1).default(0.5),\n  timeoutMs: z.number().int().positive().default(4000),\n  maxBlocksPerTask: z.number().int().min(0).default(1),\n  provider: z.enum([\"auto\", \"typesafe\", \"openrouter\"]).default(\"auto\"),\n  /** Jev model on the TypeSafe transport. */\n  model: z.string().default(\"jev-latest\"),\n  /** Jev model on the OpenRouter transport. */\n  openrouterModel: z.string().default(\"typesafe/jev-1.13\"),\n  /** Explicit TypeSafe key; otherwise TYPESAFE_API_KEY from the API process env. */\n  apiKey: z.string().optional(),\n});\n\ntype Cfg = z.infer<typeof config>;\ntype Swarm = ApiCtx[\"swarm\"];\n\nconst NS = \"ext:comms-gate\";\nconst TYPESAFE_ENDPOINT = \"https://api.typesafe.ai/v1/systemone\";\nconst OPENROUTER_ENDPOINT = \"https://openrouter.ai/api/alpha/decisions\";\nconst UUID_RE = /^[0-9a-fA-F-]{36}$/;\n// The dispatcher cancels a handler after 5 s; leave room for the DB read and KV writes.\nconst MAX_TIMEOUT_MS = 4000;\n\nexport const cfgOf = (raw: unknown): Cfg => {\n  const parsed = config.safeParse(raw ?? {});\n  return parsed.success ? parsed.data : config.parse({});\n};\n\n// kv keys accept [a-zA-Z0-9._:/%-]\nconst safeKey = (raw: string | undefined | null): string =>\n  (raw && raw.length > 0 ? raw : \"unknown\").replace(/[^a-zA-Z0-9._-]/g, \"_\").slice(0, 120);\n\n/** SDK envelopes: {success, data:{...}} or the bare payload. */\ntype Envelope = {\n  data?: { rows?: unknown[]; value?: unknown };\n  rows?: unknown[];\n  value?: unknown;\n} | null;\n\nconst cell = (row: unknown, i: number, key: string): unknown =>\n  Array.isArray(row) ? row[i] : (row as Record<string, unknown>)?.[key];\n\n/**\n * The newest human message sits at the END of a Slack task: the\n * `<thread_context>` blob comes first and can run to thousands of chars, so a\n * leading slice of `agent_tasks.task` shows the judge everything except the\n * actual request. Take the tail, then the part after the last `</thread_context>`.\n */\nconst CTX_END = \"</thread_context>\";\nexport const latestAsk = (tail: string): string => {\n  const end = tail.lastIndexOf(CTX_END);\n  let out = (end >= 0 ? tail.slice(end + CTX_END.length) : tail)\n    .replace(/\\[Thread follow-up[^\\]]*\\]/g, \"\")\n    .trim();\n  // Some tasks end with the context block; fall back to the last messages in it.\n  if (out.length < 8) out = (end >= 0 ? tail.slice(0, end) : tail).trim().slice(-800);\n  return out.slice(0, 900);\n};\n\n// Preferences are the DEFAULT. A direct request outranks them.\nconst JUDGING_RULES = [\n  \"The requester's explicit instruction in latest_request OUTRANKS requester_preferences. Preferences describe the DEFAULT; they never override a direct request.\",\n  \"If latest_request asks for something long, detailed, creative, a story, a joke, a full explanation or a document, then length and structure serving that request are CORRECT and must NOT be penalized.\",\n  \"Judge whether agent_message serves what latest_request actually asked for, written in the requester's manner. Do not judge it against the default preference when the request overrides it.\",\n];\n\ntype Prefs = { verbosity?: unknown; tone?: unknown; language?: unknown } & Record<string, unknown>;\n\n/** One `noul` question per stated preference the gate knows how to judge. */\nexport const buildQuestions = (prefs: Prefs): Record<string, unknown> => {\n  const questions: Record<string, unknown> = {};\n  if (prefs.verbosity) {\n    questions.verbosity = {\n      type: \"noul\",\n      instructions:\n        \"Does agent_message respect the requester's verbosity preference, AS OVERRIDDEN by any explicit instruction in latest_request? Apply judging_rules.\",\n      criteria: {\n        true: \"Length and structure fit what latest_request asked for (or the stated preference when the request does not override it), and it leads with the result.\",\n        false:\n          \"Too long for what was asked, or it opens with preamble, recaps the request, narrates the process, or ends with an offer to elaborate. Length explicitly requested in latest_request is NOT a failure.\",\n      },\n    };\n  }\n  if (prefs.tone) {\n    questions.tone = {\n      type: \"noul\",\n      instructions:\n        \"Does agent_message match the requester's stated tone preference, as overridden by any explicit instruction in latest_request? Apply judging_rules.\",\n      criteria: {\n        true: \"The tone matches what the requester asked for.\",\n        false:\n          \"The tone conflicts with it (for example hedging, flattery or filler when the requester asked for direct and plain). A voice appropriate to an explicitly requested creative or narrative form is NOT a failure.\",\n      },\n    };\n  }\n  if (prefs.language) {\n    questions.language = {\n      type: \"noul\",\n      instructions: \"Is agent_message written in the requester's stated language?\",\n      criteria: {\n        true: \"Written in the stated language.\",\n        false: \"Written in a different language.\",\n      },\n    };\n  }\n  return questions;\n};\n\nconst secretCache = new Map<string, { value: string; at: number }>();\nconst KEY_TTL_MS = 5 * 60 * 1000;\nconst usable = (v: string): boolean => Boolean(v) && !v.startsWith(\"[REDACTED\");\nconst envOf = (name: string): string => String(process.env[name] ?? \"\");\n\n/**\n * Resolve a secret: explicit value, then the API process env. The API process loads\n * global swarm_config rows into process.env at boot and on config reload.\n * ctx.swarm.config_get cannot serve it: the SDK scrubs secrets to \"[REDACTED:<name>]\".\n */\nconst secret = (name: string, explicit?: string): string => {\n  const cached = secretCache.get(name);\n  if (cached && Date.now() - cached.at < KEY_TTL_MS) return cached.value;\n  const value = [String(explicit ?? \"\"), envOf(name)].find(usable) ?? \"\";\n  if (usable(value)) secretCache.set(name, { value, at: Date.now() });\n  return value;\n};\n\n/** Test hook: forget cached secrets. */\nexport const resetKeyCache = (): void => {\n  secretCache.clear();\n};\n\nexport type JevTransport = {\n  provider: \"typesafe\" | \"openrouter\";\n  endpoint: string;\n  key: string;\n  model: string;\n};\n\n/**\n * Pick the Jev transport. `auto` prefers TypeSafe and falls back to OpenRouter.\n * Throws when the chosen provider has no usable key; the handler fails open.\n */\nexport const resolveTransport = (cfg: Cfg): JevTransport => {\n  const typesafe = (): JevTransport | null => {\n    const key = secret(\"TYPESAFE_API_KEY\", cfg.apiKey);\n    return usable(key)\n      ? { provider: \"typesafe\", endpoint: TYPESAFE_ENDPOINT, key, model: cfg.model }\n      : null;\n  };\n  const openrouter = (): JevTransport | null => {\n    const key = secret(\"OPENROUTER_API_KEY\");\n    return usable(key)\n      ? { provider: \"openrouter\", endpoint: OPENROUTER_ENDPOINT, key, model: cfg.openrouterModel }\n      : null;\n  };\n  const transport =\n    cfg.provider === \"typesafe\"\n      ? typesafe()\n      : cfg.provider === \"openrouter\"\n        ? openrouter()\n        : (typesafe() ?? openrouter());\n  if (transport) return transport;\n  throw new Error(\n    cfg.provider === \"typesafe\"\n      ? \"no TYPESAFE_API_KEY\"\n      : cfg.provider === \"openrouter\"\n        ? \"no OPENROUTER_API_KEY\"\n        : \"no TYPESAFE_API_KEY or OPENROUTER_API_KEY\",\n  );\n};\n\n/** One Jev call; returns the `noul` score per question. Throws on any failure. */\nexport const askJev = async (\n  state: Record<string, unknown>,\n  questions: Record<string, unknown>,\n  transport: JevTransport,\n  cfg: Cfg,\n  outer?: AbortSignal,\n): Promise<{ scores: Record<string, number>; latencyMs: number }> => {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), Math.min(cfg.timeoutMs, MAX_TIMEOUT_MS));\n  const onOuterAbort = () => controller.abort();\n  outer?.addEventListener(\"abort\", onOuterAbort);\n  const t0 = Date.now();\n  try {\n    const res = await fetch(transport.endpoint, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\", Authorization: `Bearer ${transport.key}` },\n      body: JSON.stringify({ state, model: transport.model, questions }),\n      signal: controller.signal,\n    });\n    if (!res.ok) throw new Error(`${transport.provider} ${res.status}`);\n    const body = (await res.json()) as { answers?: Record<string, { noul?: unknown }> } | null;\n    const answers = body?.answers;\n    if (!answers || typeof answers !== \"object\") throw new Error(\"no answers in response\");\n    const scores: Record<string, number> = {};\n    for (const [id, a] of Object.entries(answers)) {\n      if (typeof a?.noul === \"number\") scores[id] = a.noul;\n    }\n    if (Object.keys(scores).length === 0) throw new Error(\"no scores in response\");\n    return { scores, latencyMs: Date.now() - t0 };\n  } finally {\n    clearTimeout(timer);\n    outer?.removeEventListener(\"abort\", onOuterAbort);\n  }\n};\n\nconst SELFTEST = \"comms-gate-selftest\";\nconst SELFTEST_PREFS = {\n  tone: \"direct, plain, no hedging\",\n  language: \"English\",\n  verbosity:\n    \"very terse - answer in the first sentence, ~400 chars max. No preamble, no recap, no closing offer.\",\n};\nconst SELFTEST_BAD =\n  \"Great question! Let me walk you through what I did here. First I looked at the task, then I reviewed the relevant files, and after careful consideration I decided to go with option B. I hope this helps - let me know if you would like me to elaborate further on any of the above!\";\nconst SELFTEST_GOOD =\n  \"Went with option B: it is the only one that keeps the migration reversible. PR #123.\";\n\n/**\n * Run the judge on a known-bad (positive control, must score below threshold) and a\n * known-good (negative control, must score at or above it) message and record both\n * under `selftest:last`. Proves key, egress and KV from inside the API runtime\n * without touching real traffic.\n */\nconst selfTest = async (swarm: Swarm, cfg: Cfg, signal?: AbortSignal): Promise<void> => {\n  const started = Date.now();\n  try {\n    const transport = resolveTransport(cfg);\n    const questions = { verbosity: buildQuestions(SELFTEST_PREFS).verbosity };\n    const judge = (message: string) =>\n      askJev(\n        { requester_preferences: SELFTEST_PREFS, agent_message: message },\n        questions,\n        transport,\n        cfg,\n        signal,\n      ).then((r) => r.scores.verbosity ?? null);\n    const [bad, good] = await Promise.all([judge(SELFTEST_BAD), judge(SELFTEST_GOOD)]);\n    await swarm.kv_set({\n      namespace: NS,\n      key: \"selftest:last\",\n      value: {\n        at: new Date().toISOString(),\n        provider: transport.provider,\n        threshold: cfg.threshold,\n        positiveControlBadScore: bad,\n        negativeControlGoodScore: good,\n        controlsOk:\n          typeof bad === \"number\" &&\n          typeof good === \"number\" &&\n          bad < cfg.threshold &&\n          good >= cfg.threshold,\n        latencyMs: Date.now() - started,\n      },\n    });\n  } catch (err) {\n    await swarm\n      .kv_set({\n        namespace: NS,\n        key: \"selftest:last\",\n        value: {\n          at: new Date().toISOString(),\n          error: String(err).slice(0, 400),\n          latencyMs: Date.now() - started,\n        },\n      })\n      .catch(() => {});\n  }\n};\n\nconst TASK_SQL = `SELECT t.source, t.slackThreadTs, t.agentId, t.requestedByUserId,\n       json_extract(u.metadata, '$.comms') AS comms, u.name,\n       substr(t.task, 1, 400) AS askHead,\n       substr(t.task, -1400) AS askTail\nFROM agent_tasks t\nLEFT JOIN users u ON u.id = t.requestedByUserId\nWHERE t.id = ?`;\n\nconst LEAD_SQL = \"SELECT isLead FROM agents WHERE id = ?\";\n\n/**\n * Mirrors the `task.progress.write` rule store-progress enforces\n * (src/rbac/legacy-policy.ts): the caller owns the task, the task is\n * unassigned, or the caller is a lead. Lead status comes from the caller's\n * agents row, never from tool args. Extension callers return before this.\n */\nconst mayWriteProgress = async (\n  swarm: Swarm,\n  callerId: string | undefined,\n  taskAgentId: string,\n): Promise<boolean> => {\n  if (!callerId) return false;\n  if (!taskAgentId || taskAgentId === callerId) return true;\n  const q = (await swarm.db_query({ sql: LEAD_SQL, params: [callerId] })) as Envelope;\n  const row = (q?.data?.rows ?? q?.rows ?? [])[0];\n  return Number(cell(row, 0, \"isLead\") ?? 0) === 1;\n};\n\nconst extension: SwarmExtension = (api) => {\n  api.on(\"pre.tool.call\", async (event, ctx) => {\n    if (event.tool !== \"store-progress\") return;\n    if (event.requestInfo?.callOrigin === \"extension\") return;\n\n    const cfg = cfgOf(ctx.config);\n    if (cfg.mode === \"off\") return;\n\n    const args = (event.args ?? {}) as Record<string, unknown>;\n\n    // Self-test hatch: a progress call whose text starts with the sentinel runs\n    // the controls and records them under `selftest:last`.\n    if (args.status !== \"completed\") {\n      if (typeof args.progress === \"string\" && args.progress.startsWith(SELFTEST)) {\n        await selfTest(ctx.swarm, cfg, ctx.signal);\n      }\n      return;\n    }\n\n    const output = typeof args.output === \"string\" ? args.output.trim() : \"\";\n    if (!output) return;\n\n    const taskId = String(args.taskId ?? event.requestInfo?.sourceTaskId ?? \"\");\n    if (!UUID_RE.test(taskId)) return;\n\n    try {\n      const q = (await ctx.swarm.db_query({ sql: TASK_SQL, params: [taskId] })) as Envelope;\n      const row = (q?.data?.rows ?? q?.rows ?? [])[0];\n      if (!row) return;\n\n      const source = String(cell(row, 0, \"source\") ?? \"\");\n      const slackThreadTs = cell(row, 1, \"slackThreadTs\");\n      const agentId = String(cell(row, 2, \"agentId\") ?? \"\");\n      const requesterId = String(cell(row, 3, \"requestedByUserId\") ?? \"\");\n      const commsRaw = cell(row, 4, \"comms\");\n      const requesterName = String(cell(row, 5, \"name\") ?? requesterId);\n      const threadOpening = String(cell(row, 6, \"askHead\") ?? \"\");\n      const ask = latestAsk(String(cell(row, 7, \"askTail\") ?? \"\"));\n\n      // Judge only a completion store-progress will accept, so no agent can ship\n      // another task's thread and preferences to the external judge.\n      if (!(await mayWriteProgress(ctx.swarm, event.requestInfo?.agentId, agentId))) return;\n\n      // Only where the text actually reaches a human in Slack.\n      if (source !== \"slack\" && !slackThreadTs) return;\n      if (!commsRaw) return; // no stated preferences -> nothing to judge against\n      const prefs = (typeof commsRaw === \"string\" ? JSON.parse(commsRaw) : commsRaw) as Prefs;\n      if (!prefs || typeof prefs !== \"object\") return;\n\n      const questions = buildQuestions(prefs);\n      if (Object.keys(questions).length === 0) return;\n\n      const transport = resolveTransport(cfg);\n      const { scores, latencyMs } = await askJev(\n        {\n          role: \"You audit an AI agent's final message to the human who requested the work.\",\n          requester: requesterName,\n          requester_preferences: prefs,\n          latest_request: ask,\n          thread_opening: threadOpening,\n          judging_rules: JUDGING_RULES,\n          agent_message: output,\n        },\n        questions,\n        transport,\n        cfg,\n        ctx.signal,\n      );\n\n      const failed = Object.entries(scores)\n        .filter(([, v]) => v < cfg.threshold)\n        .map(([k]) => k);\n\n      const verdict = {\n        at: new Date().toISOString(),\n        taskId,\n        agentId,\n        source,\n        requester: requesterName,\n        requesterId,\n        provider: transport.provider,\n        scores,\n        failed,\n        threshold: cfg.threshold,\n        mode: cfg.mode,\n        latencyMs,\n        preferences: prefs,\n        askPreview: ask.slice(0, 400),\n        outputPreview: output.slice(0, 700),\n      };\n\n      await ctx.swarm.kv_incr({ namespace: NS, key: \"total\" });\n      await ctx.swarm.kv_set({ namespace: NS, key: \"last\", value: verdict });\n\n      if (failed.length === 0) {\n        await ctx.swarm.kv_incr({ namespace: NS, key: \"pass\" });\n        return;\n      }\n\n      await ctx.swarm.kv_incr({ namespace: NS, key: \"fail\" });\n      for (const dim of failed) {\n        await ctx.swarm.kv_incr({ namespace: NS, key: `dim:${safeKey(dim)}` });\n      }\n\n      const blocksKey = `blocks:${safeKey(taskId)}`;\n      // kv_get answers {success, data:{value}}, and {success:false} when absent.\n      const prior = (await ctx.swarm.kv_get({ namespace: NS, key: blocksKey })) as Envelope;\n      const priorBlocks = Number(prior?.data?.value ?? prior?.value ?? 0) || 0;\n      const willBlock = cfg.mode === \"enforce\" && priorBlocks < cfg.maxBlocksPerTask;\n\n      await ctx.swarm.kv_set({\n        namespace: NS,\n        key: `fail:${Date.now()}:${safeKey(taskId)}`,\n        value: { ...verdict, action: willBlock ? \"blocked\" : \"recorded\" },\n      });\n\n      if (!willBlock) {\n        await ctx.swarm.kv_incr({\n          namespace: NS,\n          key: cfg.mode === \"enforce\" ? \"escaped\" : \"shadowed\",\n        });\n        return;\n      }\n\n      await ctx.swarm.kv_incr({ namespace: NS, key: \"blocked\" });\n      await ctx.swarm.kv_incr({ namespace: NS, key: blocksKey });\n\n      const detail = failed\n        .map(\n          (d) =>\n            `${d} (${scores[d]!.toFixed(2)} vs ${cfg.threshold}) — requested: ${String(prefs[d] ?? \"\").slice(0, 220)}`,\n        )\n        .join(\"\\n\");\n\n      return block(\n        [\n          `Comms gate: this output does not match ${requesterName}'s stated preferences.`,\n          detail,\n          \"Rewrite the output to match and call store-progress again. Do not change the facts, only how they are said.\",\n        ].join(\"\\n\"),\n      );\n    } catch (err) {\n      // Fail open, always.\n      try {\n        await ctx.swarm.kv_incr({ namespace: NS, key: \"error\" });\n        await ctx.swarm.kv_set({\n          namespace: NS,\n          key: \"error:last\",\n          value: { at: new Date().toISOString(), taskId, error: String(err).slice(0, 400) },\n        });\n      } catch {\n        /* ignore */\n      }\n      ctx.log.warn(\"comms-adherence-gate: failing open\", { error: String(err) });\n      return;\n    }\n  });\n};\n\nexport default extension;\n"
+    },
+    "readme": "# comms-adherence-gate\n\nAgents finish Slack tasks with a final message a human reads. This extension judges that message against the requester's stated comms preferences and their latest request with Jev, [TypeSafe](https://typesafe.ai)'s decision model. In `enforce` it blocks a non-adherent completion once and tells the agent what to fix.\n\nInstall config:\n\n```json\n{ \"mode\": \"shadow\" }\n```\n\nStart in `shadow`, read the verdicts in KV for a few days, then switch to `enforce`.\n\n## Modes\n\n| `mode` | Effect |\n|---|---|\n| `off` | Never evaluates. |\n| `shadow` (default) | Asks Jev and records the verdict. Never blocks. |\n| `enforce` | Asks Jev, records the verdict, and blocks the `store-progress` call when a dimension fails, at most `maxBlocksPerTask` times per task. The agent gets the failed dimensions, their scores and the stated preference, and calls again. |\n\n## What it gates\n\nHook: `pre.tool.call` on `store-progress` with `status: \"completed\"` and a non-empty `output`. Calls made by extensions are skipped. The task must:\n\n1. Come from Slack (`source = \"slack\"` or a `slackThreadTs`). Other tasks pass without a Jev call.\n2. Have a requester with stated preferences in `users.metadata.comms`. A requester with none passes. Set them with the `manage-user` tool.\n\n## Decision\n\nThe gate reads the task row and asks one `noul` question per stated preference it knows: `verbosity`, `tone`, `language`. Any other key in `comms` is context only.\n\nJev sees the preferences, the requester's latest message (the text after the last `</thread_context>`, from the last 1,400 characters of the task), the first 400 characters of the task, and the output. Its judging rules say an explicit request outranks the stored default. A requested long answer, story or document is not a verbosity failure.\n\nA dimension fails when its score is below `threshold`. Any failed dimension fails the output.\n\n## Jev transport\n\nJev is reachable two ways. Both take the same request and return the same answer.\n\n| `provider` | Endpoint | Key | Model |\n|---|---|---|---|\n| `typesafe` | `POST https://api.typesafe.ai/v1/systemone` | `TYPESAFE_API_KEY` (or `apiKey`) | `model`, default `jev-latest` |\n| `openrouter` | `POST https://openrouter.ai/api/alpha/decisions` | `OPENROUTER_API_KEY` | `openrouterModel`, default `typesafe/jev-1.13` |\n| `auto` (default) | TypeSafe when its key is set, else OpenRouter | | |\n\nEach verdict row records the `provider` that answered.\n\n## Fail open\n\nEvery error lets the completion through: a missing key, an HTTP error, a network error, a timeout, a malformed answer, or a failed DB read. The handler never throws, so an outage cannot auto-disable the extension. Each failure bumps the `error` counter and overwrites `error:last`.\n\n## Self-test\n\nCall `store-progress` with a non-completed status and `progress` starting with `comms-gate-selftest`. The gate judges a known-bad and a known-good message against a terse preference and writes `selftest:last`: both scores, the threshold, the provider, and `controlsOk` (bad below threshold and good at or above it). Real traffic is untouched.\n\n## Config\n\n| Key | Default | Notes |\n|---|---|---|\n| `mode` | `shadow` | `off`, `shadow`, or `enforce` |\n| `threshold` | `0.5` | A dimension scoring below this fails |\n| `timeoutMs` | `4000` | Jev call timeout, capped at 4000 (the dispatcher cancels a handler at 5 s) |\n| `maxBlocksPerTask` | `1` | Blocks per task in `enforce`; after that the gate records and lets it through |\n| `provider` | `auto` | `auto`, `typesafe`, or `openrouter`. See [Jev transport](#jev-transport) |\n| `model` | `jev-latest` | Jev model on TypeSafe |\n| `openrouterModel` | `typesafe/jev-1.13` | Jev model on OpenRouter |\n| `apiKey` | unset | Explicit TypeSafe key. Prefer the `TYPESAFE_API_KEY` secret below |\n\n## Required secrets\n\nRead from the API process environment at call time. Set them as global `swarm_config` secrets: the API process loads global rows into `process.env` at boot and on config reload.\n\n- `TYPESAFE_API_KEY` or `OPENROUTER_API_KEY`: one is required for any evaluation. Under `auto`, TypeSafe wins when both are set. Without either, every completion fails open.\n\nNo key is written to config, KV, logs, or a block reason.\n\n## KV namespace `ext:comms-gate`\n\n- `last`: the latest verdict, with `scores`, `failed`, `provider`, `latencyMs`, the preferences, a 400-character `askPreview` and a 700-character `outputPreview`.\n- `fail:<epochMs>:<taskId>`: one row per failed verdict, with `action` (`blocked` or `recorded`).\n- `blocks:<taskId>`: blocks issued for that task.\n- `error:last`, `selftest:last`.\n- Counters: `total`, `pass`, `fail`, `blocked`, `escaped` (enforce, block budget spent), `shadowed`, `error`, and `dim:<dimension>`.\n\n## Known limits\n\n- Only the last 1,400 characters of the task are searched for the latest request. A very long final message is cut to its last 900 characters.\n- The block budget is per task, so a retried completion after a block goes through once the budget is spent, even if it still fails.\n"
+  },
   "deploy-awareness": {
     "manifestFile": "manifest.json",
     "manifest": {