@desplega.ai/agent-swarm 2.0.0 → 2.1.0

package/src/http/model-profiles.ts

@@ -0,0 +1,303 @@
+// Model profiles CRUD (runbooks/model-tiers.md § Model profiles).
+//
+// A profile is a named harness + model + optional effort. Lead picks one per
+// task (`profile` on send-task / POST /api/tasks) or sets it as an agent's
+// default (PATCH /api/agents/{id}/runtime { profile }); claim resolves it.
+// Reads are open to every caller; writes are operator-only (`models.profiles.write`).
+
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { isAlias } from "@desplega/model-catalog";
+import { z } from "zod";
+import { resolveHttpAuditUserId } from "../be/audit-user";
+import {
+  createModelProfile,
+  deleteModelProfile,
+  getModelProfileByName,
+  listModelProfiles,
+  modelProfileReferences,
+  updateModelProfile,
+} from "../be/db/model-profiles";
+import { explicitModelError } from "../be/model-validation";
+import { supportedReasoningLevels } from "../providers/reasoning-effort";
+import { can } from "../rbac";
+import {
+  ModelProfileNameSchema,
+  ModelProfileSchema,
+  type ProviderName,
+  ProviderNameSchema,
+  type ReasoningEffort,
+  ReasoningEffortSchema,
+} from "../types";
+import { agentFirstPrincipal } from "./request-principal";
+import { route } from "./route-def";
+import { jsonError } from "./utils";
+
+const listProfiles = route({
+  method: "get",
+  path: "/api/model-profiles",
+  pattern: ["api", "model-profiles"],
+  summary: "List model profiles",
+  description:
+    "Every model profile, ordered by harness then name. Filter by `harness` to see what an agent on that harness can run.",
+  tags: ["Models"],
+  query: z.object({ harness: ProviderNameSchema.optional() }),
+  responses: {
+    200: {
+      description: "Model profiles",
+      schema: z.object({ profiles: z.array(ModelProfileSchema) }),
+    },
+  },
+});
+
+const getProfile = route({
+  method: "get",
+  path: "/api/model-profiles/{name}",
+  pattern: ["api", "model-profiles", null],
+  summary: "Get one model profile",
+  tags: ["Models"],
+  params: z.object({ name: z.string() }),
+  responses: {
+    200: { description: "The model profile", schema: ModelProfileSchema },
+    404: { description: "No profile with that name" },
+  },
+});
+
+const createProfile = route({
+  method: "post",
+  path: "/api/model-profiles",
+  pattern: ["api", "model-profiles"],
+  summary: "Create a model profile",
+  description:
+    "A profile runs on one harness. `model` must run on that harness and be in the model catalog unless `allowCustomModel` is true (a gateway id, a fresh launch); a `latest:` alias is accepted and resolves at claim. `effort` must be a level the harness and model support. Operator only (the shared API key).",
+  tags: ["Models"],
+  rbac: { permission: "models.profiles.write" },
+  body: z.object({
+    name: ModelProfileNameSchema,
+    harness: ProviderNameSchema,
+    model: z.string().trim().min(1),
+    effort: ReasoningEffortSchema.nullable().optional(),
+    allowCustomModel: z.boolean().optional().default(false),
+    description: z.string().trim().max(500).nullable().optional(),
+  }),
+  responses: {
+    201: { description: "Profile created", schema: ModelProfileSchema },
+    400: { description: "Validation error" },
+    403: { description: "Forbidden" },
+    409: { description: "A profile with that name exists" },
+  },
+});
+
+const updateProfile = route({
+  method: "patch",
+  path: "/api/model-profiles/{name}",
+  pattern: ["api", "model-profiles", null],
+  summary: "Update a model profile",
+  description:
+    "Changes the model, effort, custom-model flag or description; the name and harness are fixed. Omit a field to keep it; `effort: null` clears it. Applies to tasks claimed after the change. Operator only (the shared API key).",
+  tags: ["Models"],
+  rbac: { permission: "models.profiles.write" },
+  params: z.object({ name: z.string() }),
+  body: z.object({
+    model: z.string().trim().min(1).optional(),
+    effort: ReasoningEffortSchema.nullable().optional(),
+    allowCustomModel: z.boolean().optional(),
+    description: z.string().trim().max(500).nullable().optional(),
+  }),
+  responses: {
+    200: { description: "Profile updated", schema: ModelProfileSchema },
+    400: { description: "Validation error" },
+    403: { description: "Forbidden" },
+    404: { description: "No profile with that name" },
+  },
+});
+
+const deleteProfile = route({
+  method: "delete",
+  path: "/api/model-profiles/{name}",
+  pattern: ["api", "model-profiles", null],
+  summary: "Delete a model profile",
+  description:
+    "Refused (409) for a shipped `<harness>-<tier>` seed (edit it instead; it would come back at the next boot), and while an agent has the profile as its default or a task holds it (unfinished, or superseded and still owed its resume). Operator only (the shared API key).",
+  tags: ["Models"],
+  rbac: { permission: "models.profiles.write" },
+  params: z.object({ name: z.string() }),
+  responses: {
+    200: { description: "Profile deleted", schema: z.object({ deleted: z.literal(true) }) },
+    403: { description: "Forbidden" },
+    404: { description: "No profile with that name" },
+    409: { description: "The profile is a seed or still in use" },
+  },
+});
+
+/** Why `harness` + `model` + `effort` is not a valid profile, or null. */
+async function profileValueError(input: {
+  harness: ProviderName;
+  model: string;
+  effort: ReasoningEffort | null | undefined;
+  allowCustomModel: boolean;
+}): Promise<string | null> {
+  const modelError = await explicitModelError({
+    model: input.model,
+    allowCustomModel: input.allowCustomModel,
+    harnessProvider: input.harness,
+  });
+  if (modelError) return modelError;
+  // The levels the harness and model accept (as PATCH /runtime checks them); a
+  // supported level may still be a transport no-op, like Opencode `off`. An
+  // alias is judged once it resolves.
+  if (
+    input.effort &&
+    !isAlias(input.model) &&
+    !supportedReasoningLevels(input.harness, input.model).includes(input.effort)
+  ) {
+    return `Effort "${input.effort}" is not supported by ${input.model} on ${input.harness}.`;
+  }
+  return null;
+}
+
+/** Gate a write on `models.profiles.write`; writes a 403 and returns false on denial. */
+async function canWriteProfiles(
+  req: IncomingMessage,
+  res: ServerResponse,
+  myAgentId: string | undefined,
+): Promise<boolean> {
+  const decision = can({
+    principal: await agentFirstPrincipal(req, myAgentId),
+    verb: "models.profiles.write",
+    resource: { kind: "none" },
+    source: "http",
+  });
+  if (!decision.allow) {
+    jsonError(res, "Writing model profiles requires the operator", 403);
+    return false;
+  }
+  return true;
+}
+
+export async function handleModelProfiles(
+  req: IncomingMessage,
+  res: ServerResponse,
+  pathSegments: string[],
+  queryParams: URLSearchParams,
+  myAgentId: string | undefined,
+): Promise<boolean> {
+  if (listProfiles.match(req.method, pathSegments)) {
+    const parsed = await listProfiles.parse(req, res, pathSegments, queryParams);
+    if (!parsed) return true;
+    listProfiles.respond(res, 200, {
+      profiles: await listModelProfiles({ harness: parsed.query.harness }),
+    });
+    return true;
+  }
+
+  if (getProfile.match(req.method, pathSegments)) {
+    const parsed = await getProfile.parse(req, res, pathSegments, queryParams);
+    if (!parsed) return true;
+    const profile = await getModelProfileByName(parsed.params.name);
+    if (!profile) {
+      jsonError(res, "Model profile not found", 404);
+      return true;
+    }
+    getProfile.respond(res, 200, profile);
+    return true;
+  }
+
+  if (createProfile.match(req.method, pathSegments)) {
+    const parsed = await createProfile.parse(req, res, pathSegments, queryParams);
+    if (!parsed) return true;
+    if (!(await canWriteProfiles(req, res, myAgentId))) return true;
+    const body = parsed.body;
+    const error = await profileValueError({ ...body, effort: body.effort ?? null });
+    if (error) {
+      jsonError(res, error, 400);
+      return true;
+    }
+    const created = await createModelProfile(body, {
+      userId: await resolveHttpAuditUserId(req, myAgentId),
+    });
+    if (!created) {
+      jsonError(res, `Model profile "${body.name}" already exists`, 409);
+      return true;
+    }
+    createProfile.respond(res, 201, created);
+    return true;
+  }
+
+  if (updateProfile.match(req.method, pathSegments)) {
+    const parsed = await updateProfile.parse(req, res, pathSegments, queryParams);
+    if (!parsed) return true;
+    if (!(await canWriteProfiles(req, res, myAgentId))) return true;
+    const current = await getModelProfileByName(parsed.params.name);
+    if (!current) {
+      jsonError(res, "Model profile not found", 404);
+      return true;
+    }
+    const body = parsed.body;
+    const error = await profileValueError({
+      harness: current.harness,
+      model: body.model ?? current.model,
+      effort: body.effort === undefined ? current.effort : body.effort,
+      allowCustomModel: body.allowCustomModel ?? current.allowCustomModel,
+    });
+    if (error) {
+      jsonError(res, error, 400);
+      return true;
+    }
+    const updated = await updateModelProfile(current.name, body, {
+      userId: await resolveHttpAuditUserId(req, myAgentId),
+    });
+    if (!updated) {
+      jsonError(res, "Model profile not found", 404);
+      return true;
+    }
+    updateProfile.respond(res, 200, updated);
+    return true;
+  }
+
+  if (deleteProfile.match(req.method, pathSegments)) {
+    const parsed = await deleteProfile.parse(req, res, pathSegments, queryParams);
+    if (!parsed) return true;
+    if (!(await canWriteProfiles(req, res, myAgentId))) return true;
+    const current = await getModelProfileByName(parsed.params.name);
+    if (!current) {
+      jsonError(res, "Model profile not found", 404);
+      return true;
+    }
+    if (current.seededFrom?.startsWith("tier:")) {
+      jsonError(
+        res,
+        `"${current.name}" is a shipped tier profile and comes back at the next boot; edit it instead.`,
+        409,
+      );
+      return true;
+    }
+    const refs = await modelProfileReferences(current.name);
+    if (refs.agentIds.length > 0 || refs.openTaskCount > 0) {
+      jsonError(
+        res,
+        `"${current.name}" is in use: default of ${refs.agentIds.length} agent(s), held by ${refs.openTaskCount} unfinished or awaiting-resume task(s).`,
+        409,
+      );
+      return true;
+    }
+    // The count above is for the message; the delete re-checks in the same
+    // statement (migration 220 trigger), so a reference written since is a 409.
+    const outcome = await deleteModelProfile(current.name);
+    if (outcome === "in-use") {
+      jsonError(
+        res,
+        `"${current.name}" is in use by a task or an agent default created just now.`,
+        409,
+      );
+      return true;
+    }
+    if (outcome === "missing") {
+      jsonError(res, "Model profile not found", 404);
+      return true;
+    }
+    deleteProfile.respond(res, 200, { deleted: true });
+    return true;
+  }
+
+  return false;
+}

package/src/http/pages-public.ts

@@ -25,7 +25,11 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
 import { getPage, incrementPageViewCount } from "../be/db";
 import { BROWSER_SDK_JS, SWARM_UI_JS } from "../pages/browser-sdk";
-import { feedbackOverlayScripts, isPageFeedbackRequested } from "../pages/feedback-overlay";
+import {
+  feedbackKeyGuardScript,
+  feedbackOverlayScripts,
+  isPageFeedbackRequested,
+} from "../pages/feedback-overlay";
 import { type Page, PageSchema } from "../types";
 import { getAppUrl, getConfiguredAppUrls } from "../utils/constants";
 import { getNodeEnv } from "../utils/node-env";
@@ -170,8 +174,8 @@ const PAGE_HEAD_DEFAULTS = `<base target="_blank">
   }
 </style>`;
 
-function injectBrowserSdk(html: string): string {
-  const injection = `${PAGE_HEAD_DEFAULTS}<script>${BROWSER_SDK_JS}</script><script>${SWARM_UI_JS}</script>`;
+function injectBrowserSdk(html: string, headFirst = ""): string {
+  const injection = `${headFirst}${PAGE_HEAD_DEFAULTS}<script>${BROWSER_SDK_JS}</script><script>${SWARM_UI_JS}</script>`;
   // Use the first occurrence of `<head>` (case-insensitive). A page that
   // doesn't have a `<head>` element (raw fragment) still gets the SDK at the
   // front of the document.
@@ -646,10 +650,12 @@ export async function handlePagesPublic(
   // text/html — inject SDK + serve. Append the self-print snippet when the
   // export button requested it, and the feedback overlay when
   // `?__swarm-feedback` is on (the overlay hides itself in print).
+  // The feedback key guard goes first in <head> so it runs before page scripts.
+  const feedback = isPageFeedbackRequested(queryParams);
   const html =
-    injectBrowserSdk(page.body) +
+    injectBrowserSdk(page.body, feedback ? feedbackKeyGuardScript() : "") +
     (wantsPrint ? PRINT_AUTOTRIGGER_SCRIPT : "") +
-    (isPageFeedbackRequested(queryParams) ? feedbackOverlayScripts(page.id) : "");
+    (feedback ? feedbackOverlayScripts(page.id) : "");
   const headers: Record<string, string> = {
     "Content-Type": "text/html; charset=utf-8",
     "Cache-Control": "no-store",

package/src/http/poll.ts

@@ -41,7 +41,9 @@ import { AgentTaskSchema, BudgetRefusedTriggerSchema, TaskAttachmentSchema } fro
 import { ensure } from "../utils/business-use";
 import { isLeadChannelMonitoringEnabled } from "../utils/lead-monitor-channels";
 import { isMultiRuntimeEnabled } from "../utils/multi-runtime";
+import { getRequestAuth, type HttpRequestAuth } from "../utils/request-auth-context";
 import { isRuntimePoolsEnabled } from "../utils/runtime-pools-flag";
+import { readsRepoSecrets } from "./config";
 import { buildTaskRequestedBy, TaskRequestedBySchema } from "./requested-by";
 import { route, runtimeInstanceHeader } from "./route-def";
 import { jsonError } from "./utils";
@@ -208,8 +210,14 @@ async function attachmentsForTrigger(
  * previous claim record is overwritten for the same reason.
  */
 async function claimModelFields(
-  task: TaskModelPinFields & { id: string },
-  agent: Parameters<typeof recordClaimModelResolution>[1],
+  task: TaskModelPinFields & {
+    id: string;
+    profile?: string | null;
+    effort?: string | null;
+    vcsRepo?: string | null;
+  },
+  agent: Parameters<typeof recordClaimModelResolution>[1] & { isLead?: boolean },
+  auth: HttpRequestAuth | null,
 ): Promise<Awaited<ReturnType<typeof recordClaimModelResolution>> & { model: string | undefined }> {
   const pin = taskModelPin(task);
   const cleared = {
@@ -217,11 +225,14 @@ async function claimModelFields(
     resolvedModel: undefined,
     modelSource: undefined,
     modelAlias: undefined,
+    resolvedProfile: undefined,
   };
   try {
     return {
       ...cleared,
-      ...(await recordClaimModelResolution({ ...task, model: pin }, agent)),
+      ...(await recordClaimModelResolution({ ...task, model: pin }, agent, {
+        includeRepoSecrets: readsRepoSecrets(auth, agent),
+      })),
     };
   } catch (error) {
     console.warn(`[/api/poll] model resolution failed for task ${task.id}:`, error);
@@ -495,7 +506,7 @@ export async function handlePoll(
                 triggerSurface: assignedTriggerSurface,
                 task: {
                   ...pendingTask,
-                  ...(await claimModelFields(pendingTask, agent)),
+                  ...(await claimModelFields(pendingTask, agent, getRequestAuth(req))),
                   status: "in_progress",
                   attachments: await attachmentsForTrigger(pendingTask.id),
                 },
@@ -639,7 +650,7 @@ export async function handlePoll(
                     triggerSurface: claimedTriggerSurface,
                     task: {
                       ...claimed,
-                      ...(await claimModelFields(claimed, agent)),
+                      ...(await claimModelFields(claimed, agent, getRequestAuth(req))),
                       attachments: await attachmentsForTrigger(claimed.id),
                     },
                     ...(claimedRequestedBy && { requestedBy: claimedRequestedBy }),

package/src/http/script-runs.ts

@@ -611,7 +611,7 @@ export async function handleScriptRuns(
     if (!parsed) return true;
     const result = await executeRawLlm(parsed.body);
     if (result.status === "failed") {
-      json(res, { error: result.error }, 500);
+      jsonError(res, result.error, 500);
       return true;
     }
     rawLlmRoute.respond(res, 200, result.output);

package/src/http/scripts.ts

@@ -41,6 +41,7 @@ import {
 import { can } from "../rbac";
 import { extractScriptSignature, type ScriptSignature } from "../scripts-runtime/extract-signature";
 import { runScript } from "../scripts-runtime/loader";
+import { checkQuickJSCompat, quickJSCompatWarnings } from "../scripts-runtime/quickjs-compat";
 import {
   ScriptApiAuthModeSchema,
   ScriptApiRecordSchema,
@@ -236,6 +237,10 @@ const upsertRoute = route({
         name: z.string(),
         version: z.number(),
         contentDeduped: z.boolean(),
+        warnings: z
+          .array(z.string())
+          .optional()
+          .describe("Advisory quickjs-executor compatibility findings. Never blocks the save."),
       }),
     },
     400: { description: "Validation or typecheck failure" },
@@ -424,7 +429,15 @@ const createScriptApiRoute = route({
   params: idParamsSchema,
   body: createScriptApiBodySchema,
   responses: {
-    201: { description: "Endpoint created", schema: scriptApiWithSecretSchema },
+    201: {
+      description: "Endpoint created",
+      schema: scriptApiWithSecretSchema.extend({
+        warnings: z
+          .array(z.string())
+          .optional()
+          .describe("Advisory quickjs-executor compatibility findings for the script."),
+      }),
+    },
     400: { description: "Validation error or script has no owning agent" },
     404: { description: "Script not found" },
   },
@@ -702,10 +715,14 @@ export async function handleScripts(
       });
     }
 
+    const warnings = quickJSCompatWarnings(
+      checkQuickJSCompat(parsed.body.source, { fsMode: parsed.body.fsMode }),
+    );
     upsertRoute.respond(res, 200, {
       name: result.script.name,
       version: result.script.version,
       contentDeduped: result.contentDeduped,
+      ...(warnings.length > 0 ? { warnings } : {}),
     });
     return true;
   }
@@ -1092,7 +1109,13 @@ export async function handleScripts(
       label: parsed.body.label ?? null,
       createdBy: await resolveHttpAuditUserId(req, agentId),
     });
-    createScriptApiRoute.respond(res, 201, endpoint);
+    const warnings = quickJSCompatWarnings(
+      checkQuickJSCompat(script.source, { fsMode: script.fsMode }),
+    );
+    createScriptApiRoute.respond(res, 201, {
+      ...endpoint,
+      ...(warnings.length > 0 ? { warnings } : {}),
+    });
     return true;
   }
 

package/src/http/tasks.ts

@@ -35,6 +35,7 @@ import {
   updateTaskTitle,
   updateTaskVcs,
 } from "../be/db";
+import { modelProfileRefError, taskProfileError } from "../be/db/model-profiles";
 import { explicitModelErrorForAgent } from "../be/model-validation";
 import {
   getTaskSteeringFields,
@@ -287,6 +288,8 @@ const createTask = route({
        */
       allowCustomModel: z.boolean().optional(),
       effort: ReasoningEffortSchema.optional(),
+      /** Model profile name, applied at claim. Exclusive with `model` and `modelTier`. */
+      profile: z.string().trim().min(1).optional(),
       /**
        * Create in `draft` status instead of the normal pending/unassigned/offered
        * status (#1240) — the task exists and is visible to its owner, but is not
@@ -966,6 +969,15 @@ export async function handleTasks(
       jsonError(res, modelError, 400);
       return true;
     }
+    const profileError = await taskProfileError({
+      profile: parsed.body.profile,
+      ...splitLegacyModelAlias({ model: parsed.body.model, modelTier: parsed.body.modelTier }),
+      agentId: defaultAgentId,
+    });
+    if (profileError) {
+      jsonError(res, profileError, 400);
+      return true;
+    }
 
     const parentTask = parsed.body.parentTaskId
       ? await getTaskById(parsed.body.parentTaskId)
@@ -1057,6 +1069,7 @@ export async function handleTasks(
             modelTier: parsed.body.modelTier,
           }),
           effort: parsed.body.effort,
+          profile: parsed.body.profile,
         },
         { origin: "rest", allowCustomModel: parsed.body.allowCustomModel },
       );
@@ -1087,6 +1100,11 @@ export async function handleTasks(
         jsonError(res, error.message, 400);
         return true;
       }
+      // The profile was deleted between taskProfileError and the insert.
+      if (modelProfileRefError(error) === "missing") {
+        jsonError(res, `Unknown model profile "${parsed.body.profile}"`, 400);
+        return true;
+      }
       console.error("[HTTP] Failed to create task:", error);
       jsonError(res, "Failed to create task", 500);
     }

package/src/http/webhooks.ts

@@ -757,9 +757,8 @@ export async function handleWebhooks(
       payload.message &&
       !isInboxAllowed(payload.message.inbox_id, process.env.AGENTMAIL_INBOX_DOMAIN_FILTER)
     ) {
-      const domain = payload.message.inbox_id.split("@")[1] ?? "unknown";
       console.log(
-        `[AgentMail] Ignoring event for inbox domain "${domain}" (not in AGENTMAIL_INBOX_DOMAIN_FILTER)`,
+        `[AgentMail] Ignoring event for inbox "${payload.message.inbox_id}" (not in AGENTMAIL_INBOX_DOMAIN_FILTER)`,
       );
       return true;
     }

package/src/pages/feedback-overlay.ts

@@ -25,6 +25,43 @@ export function isPageFeedbackRequested(queryParams: URLSearchParams): boolean {
   return value !== "0" && value !== "false";
 }
 
+// Keys typed in the overlay must never reach the page's own key handlers. A
+// listener on the overlay runs too late: page capture listeners on window and
+// document fire first. So this guard is served at the top of <head>, before any
+// page script, and is the first window capture listener. For a key from the
+// overlay it stops dispatch outright and hands the event to the overlay
+// (window.__swarmFeedbackKeys.handle). A press that started in the overlay
+// stays owned until its keyup, so the release is swallowed even after the
+// composer closed and focus moved to the page. Every other key passes through.
+// The overlay script repeats it as a fallback; the second run is a no-op.
+const FEEDBACK_KEY_GUARD_JS = `
+(function () {
+  if (window.__swarmFeedbackKeys) return;
+  var keys = window.__swarmFeedbackKeys = { host: null, handle: null };
+  var owned = {};
+  function id(e) { return e.code || e.key; }
+  function fromOverlay(e) {
+    return !!keys.host && typeof e.composedPath === 'function' && e.composedPath().indexOf(keys.host) !== -1;
+  }
+  function guard(e) {
+    var k = id(e);
+    var mine = fromOverlay(e);
+    if (!mine && !owned[k]) return;
+    if (e.type === 'keydown') {
+      if (mine) owned[k] = true;
+      else if (!e.repeat) { delete owned[k]; return; }
+    }
+    if (e.type === 'keyup') delete owned[k];
+    e.stopImmediatePropagation();
+    if (mine && keys.handle) keys.handle(e);
+  }
+  ['keydown', 'keypress', 'keyup'].forEach(function (type) {
+    window.addEventListener(type, guard, true);
+  });
+  window.addEventListener('blur', function () { owned = {}; });
+})();
+`;
+
 const FEEDBACK_OVERLAY_JS = `
 (function () {
   var cfg = window.__swarmFeedback;
@@ -135,6 +172,7 @@ const FEEDBACK_OVERLAY_JS = `
   var panel = document.createElement('div');
   panel.className = 'panel';
   var composer = null;
+  var composerInput = null;
   root.appendChild(hl);
   root.appendChild(markers);
   root.appendChild(panel);
@@ -207,11 +245,25 @@ const FEEDBACK_OVERLAY_JS = `
     }
     render();
   }
-  document.addEventListener('keydown', function (e) {
-    if (e.key !== 'Escape') return;
+  function onEscape() {
     if (state.draft) { closeComposer(); return; }
     if (state.selecting) setSelecting(false);
+  }
+  // Escape pressed on the page while selecting. Keys typed in the overlay never
+  // get here: the key guard stops them and calls onOverlayKey instead.
+  document.addEventListener('keydown', function (e) {
+    if (e.key === 'Escape') onEscape();
   }, true);
+  function onOverlayKey(e) {
+    if (e.type !== 'keydown') return;
+    if (e.key === 'Escape') { onEscape(); return; }
+    if (e.key === 'Enter' && (e.metaKey || e.ctrlKey) && composerInput && e.composedPath()[0] === composerInput) {
+      e.preventDefault();
+      commitDraft(composerInput.value);
+    }
+  }
+  window.__swarmFeedbackKeys.host = host;
+  window.__swarmFeedbackKeys.handle = onOverlayKey;
 
   // ─── Composer ──────────────────────────────────────────────────────────
   function openComposer(target) {
@@ -230,9 +282,7 @@ const FEEDBACK_OVERLAY_JS = `
     add.type = 'button';
     cancel.addEventListener('click', closeComposer);
     add.addEventListener('click', function () { commitDraft(input.value); });
-    input.addEventListener('keydown', function (e) {
-      if (e.key === 'Enter' && (e.metaKey || e.ctrlKey)) { e.preventDefault(); commitDraft(input.value); }
-    });
+    composerInput = input;
     row.appendChild(cancel);
     row.appendChild(add);
     composer.appendChild(row);
@@ -253,6 +303,7 @@ const FEEDBACK_OVERLAY_JS = `
   function closeComposer() {
     if (composer) composer.remove();
     composer = null;
+    composerInput = null;
     state.draft = null;
     hideHighlight();
   }
@@ -524,5 +575,13 @@ const FEEDBACK_OVERLAY_JS = `
  */
 export function feedbackOverlayScripts(pageId: string): string {
   const config = JSON.stringify({ pageId }).replace(/</g, "\\u003c");
-  return `<script>window.__swarmFeedback = ${config};</script><script>${FEEDBACK_OVERLAY_JS}</script>`;
+  return `<script>window.__swarmFeedback = ${config};</script><script>${FEEDBACK_KEY_GUARD_JS}${FEEDBACK_OVERLAY_JS}</script>`;
+}
+
+/**
+ * Key guard served at the top of `<head>` when feedback mode is on, so it runs
+ * before any page script and its window capture listeners come first.
+ */
+export function feedbackKeyGuardScript(): string {
+  return `<script>${FEEDBACK_KEY_GUARD_JS}</script>`;
 }

package/src/providers/acp-targets.ts

@@ -359,7 +359,7 @@ const copilotTargetProfile: AcpTargetProfile = {
   },
 };
 
-/** Qwen Code's `--auth-type` choices (0.25.1). `qwen-oauth` needs a browser, so it is left out. */
+/** Qwen Code's `--auth-type` choices (0.25.2). `qwen-oauth` needs a browser, so it is left out. */
 const QWEN_AUTH_TYPES = ["openai", "openai-responses", "anthropic", "gemini", "vertex-ai"] as const;
 
 // Qwen Code is a Gemini CLI fork: QWEN_SYSTEM_MD replaces its built-in prompt

package/src/providers/amp-adapter.ts

@@ -44,7 +44,7 @@ import type {
  * default; the image installs exactly this version and the per-task settings
  * set `amp.updates.mode: "disabled"`. Bump it deliberately, with a live run.
  */
-export const AMP_PACKAGE = "@ampcode/cli@0.0.1792065649-g5a30fc";
+export const AMP_PACKAGE = "@ampcode/cli@0.0.1792152053-g57ff9b";
 
 /** MCP server name. Amp exposes its tools as `agent_swarm` / `store_progress` (dashes become underscores). */
 const AMP_MCP_SERVER_NAME = "agent-swarm";