@desplega.ai/agent-swarm 2.5.4 → 2.6.0

package/src/http/tasks.ts

@@ -227,6 +227,8 @@ const listTasks = route({
     status: z.string().optional(),
     agentId: z.string().optional(),
     scheduleId: z.string().optional(),
+    /** Only tasks of this workflow run (indexed; independent of fleet size). */
+    workflowRunId: z.string().uuid().optional(),
     key: AssetKeySchema.optional(),
     keyPrefix: AssetKeySchema.optional(),
     search: z.string().optional(),
@@ -976,6 +978,7 @@ export async function handleTasks(
       status,
       agentId: parsed.query.agentId || undefined,
       scheduleId: parsed.query.scheduleId || undefined,
+      workflowRunId: parsed.query.workflowRunId,
       key: parsed.query.key,
       keyPrefix: parsed.query.keyPrefix,
       search: parsed.query.search || undefined,

package/src/http/used-by.ts

@@ -2,7 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
 import { getDbClient, upsertSwarmConfig } from "../be/db";
 import { isTelemetryEnabled, trackRelayed } from "../telemetry";
-import { USER_FUNCTIONS } from "../utils/company-profile";
+import { reportedUserFunction, USER_FUNCTIONS } from "../utils/company-profile";
 import { orgIdentityStatus } from "../utils/org-identity";
 import { normalizeOrgWebsite, TELEMETRY_PROXY_ORIGIN } from "../utils/org-website";
 import { ensureConfigAdmin } from "./config";
@@ -129,7 +129,12 @@ export async function handleUsedBy(
         ...(orgDomain ? { org_domain: orgDomain } : {}),
         granted,
         ...(granted
-          ? { contact_email: contactEmail, contact_function: contactFunction, quote }
+          ? {
+              contact_email: contactEmail,
+              // The proxy rejects a job function its catalog does not list yet.
+              contact_function: reportedUserFunction(contactFunction),
+              quote,
+            }
           : {}),
         changed_at: changedAt,
       }),

package/src/http/workflows.ts

@@ -23,7 +23,14 @@ import {
   type WorkflowIdempotencyClaim,
   workflowRequestFingerprint,
 } from "../be/db/workflow-idempotency";
-import { getWorkflowRunParent } from "../be/db/workflow-runs";
+import {
+  getWorkflowRunParent,
+  getWorkflowRunStepsSlimByRunId,
+  getWorkflowRunSummary,
+  getWorkflowRunTree,
+  WORKFLOW_RUN_TREE_MAX_DEPTH,
+  WorkflowRunTreeError,
+} from "../be/db/workflow-runs";
 import {
   AssetKeySchema,
   AutomationIntegrationIdSchema,
@@ -39,6 +46,7 @@ import {
   WorkflowRunSchema,
   WorkflowRunStatusSchema,
   WorkflowRunStepSchema,
+  WorkflowRunStepSlimSchema,
   WorkflowRunSummarySchema,
   WorkflowSchema,
   WorkflowVersionSchema,
@@ -109,6 +117,13 @@ const WorkflowRunPageSchema = z.object({
   }),
 });
 
+/** Mirrors `WorkflowRunTree` in src/be/db/workflow-runs.ts. */
+const WorkflowRunTreeSchema = z.object({
+  rootRunId: z.string(),
+  runs: z.array(WorkflowRunSummarySchema),
+  hasOpenWork: z.boolean(),
+});
+
 const SuccessResponseSchema = z.object({ success: z.literal(true) });
 
 /** Adds `warnings` to a just-saved workflow when a node in it cannot run yet. */
@@ -349,22 +364,50 @@ const getWorkflowRunRoute = route({
   path: "/api/workflow-runs/{id}",
   pattern: ["api", "workflow-runs", null],
   summary: "Get a workflow run with steps (includes retry columns)",
+  description:
+    "Returns the run with its `context` and every step with its `input` by default. A step's `input` is a snapshot of the context when the step started, so in runs with loops (polling, `wait`, iterations) the response grows with steps × context size. Pass `fields=slim` to drop `run.context` and `steps[].input`; outputs, errors, diagnostics, retry fields and `parent` stay.",
   tags: ["Workflows"],
   params: z.object({ id: z.string() }),
+  query: z.object({
+    /** `slim` omits `run.context` and `steps[].input`; default is full. */
+    fields: z.enum(["full", "slim"]).optional(),
+  }),
   responses: {
     200: {
       description: "Workflow run details with steps including retry info",
-      schema: z.object({
-        run: WorkflowRunSchema,
-        steps: z.array(WorkflowRunStepSchema),
-        /** Set on a child run: the run and `sub-workflow` step that started it. */
-        parent: WorkflowRunParentSchema.optional(),
-      }),
+      schema: z.union([
+        z.object({
+          run: WorkflowRunSchema,
+          steps: z.array(WorkflowRunStepSchema),
+          /** Set on a child run: the run and `sub-workflow` step that started it. */
+          parent: WorkflowRunParentSchema.optional(),
+        }),
+        z.object({
+          run: WorkflowRunSummarySchema,
+          steps: z.array(WorkflowRunStepSlimSchema),
+          parent: WorkflowRunParentSchema.optional(),
+        }),
+      ]),
     },
     404: { description: "Run not found" },
   },
 });
 
+const getWorkflowRunTreeRoute = route({
+  method: "get",
+  path: "/api/workflow-runs/{id}/tree",
+  pattern: ["api", "workflow-runs", null, "tree"],
+  summary: "Get a workflow run and every sub-workflow run below it",
+  description: `Follows stored parent links (\`parentStepId\` → step → run) through every attempt of every step, terminal runs included. \`runs\` holds list rows without \`context\`, root first. \`hasOpenWork\` is true while any run in the tree is live, has a pending, running or waiting step, a queued retry, an open task or a pending approval; after a cancel it turns false once the tree has settled. Both come from one read snapshot. The tree is not paginated. Links that form a cycle or nest deeper than ${WORKFLOW_RUN_TREE_MAX_DEPTH} levels return 409.`,
+  tags: ["Workflows"],
+  params: z.object({ id: z.string() }),
+  responses: {
+    200: { description: "The run tree", schema: WorkflowRunTreeSchema },
+    404: { description: "Run not found" },
+    409: { description: "Stored parent links form a cycle or nest past the depth bound" },
+  },
+});
+
 const retryWorkflowRunRoute = route({
   method: "post",
   path: "/api/workflow-runs/{id}/retry",
@@ -1014,18 +1057,44 @@ export async function handleWorkflows(
     const parsed = await getWorkflowRunRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
     // Display view: the scrubbed context and step outputs, never replay state.
-    const run = await getWorkflowRun(parsed.params.id, "display");
+    // `fields=slim` skips the context and step-input columns in SQL too.
+    const slim = parsed.query.fields === "slim";
+    const run = slim
+      ? await getWorkflowRunSummary(parsed.params.id)
+      : await getWorkflowRun(parsed.params.id, "display");
     if (!run) {
       res.writeHead(404);
       res.end();
       return true;
     }
-    const steps = await getWorkflowRunStepsByRunId(parsed.params.id, "display");
+    const steps = slim
+      ? await getWorkflowRunStepsSlimByRunId(parsed.params.id)
+      : await getWorkflowRunStepsByRunId(parsed.params.id, "display");
     const parent = run.parentStepId ? await getWorkflowRunParent(run.parentStepId) : null;
     getWorkflowRunRoute.respond(res, 200, { run, steps, ...(parent ? { parent } : {}) });
     return true;
   }
 
+  if (getWorkflowRunTreeRoute.match(req.method, pathSegments)) {
+    const parsed = await getWorkflowRunTreeRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed) return true;
+    let tree: Awaited<ReturnType<typeof getWorkflowRunTree>>;
+    try {
+      tree = await getWorkflowRunTree(parsed.params.id);
+    } catch (err) {
+      if (!(err instanceof WorkflowRunTreeError)) throw err;
+      jsonError(res, err.message, 409);
+      return true;
+    }
+    if (!tree) {
+      res.writeHead(404);
+      res.end();
+      return true;
+    }
+    getWorkflowRunTreeRoute.respond(res, 200, tree);
+    return true;
+  }
+
   if (retryWorkflowRunRoute.match(req.method, pathSegments)) {
     const parsed = await retryWorkflowRunRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;

package/src/integrations/chat-sdk/inbound.ts

@@ -1,5 +1,7 @@
 import type { Adapter, Message, Thread } from "chat";
 import { z } from "zod";
+import { sessionGroupKey } from "@/assets/key";
+import { sessionSourceKey } from "@/assets/source-key";
 import {
   getAgentById,
   getAgentWorkingOnContextKey,
@@ -9,6 +11,7 @@ import {
   getLeadAgent,
   isExtensionAgent,
 } from "@/be/db";
+import { rememberSessionLabel } from "@/be/db/session-labels";
 import { resolveIdentity } from "@/be/identity";
 import { recordUnmappedIdentity } from "@/be/unmapped-identities";
 import { dispatchPre } from "@/extensions/dispatcher";
@@ -373,6 +376,20 @@ async function targetFromExtension(
  * Runs outside any transaction, so `pre.chat.route` is dispatched here, after
  * the flush and before any task exists.
  */
+/**
+ * The source group label a Telegram or Discord message gives: the DM sender,
+ * or a Telegram group title. Slack labels come from the Slack lookup instead.
+ */
+function chatSourceLabel(adapter: string, item: ChatBufferedMessage): string | undefined {
+  if (adapter !== "telegram" && adapter !== "discord") return undefined;
+  const { facts } = item;
+  if (facts.chatType === "dm" || item.isDirectMessage)
+    return facts.from ? `DM · ${facts.from}` : undefined;
+  if (adapter === "telegram" && (facts.chatType === "group" || facts.chatType === "supergroup"))
+    return facts.title || undefined;
+  return undefined;
+}
+
 export async function flushChatThread(
   threadId: string,
   items: ChatBufferedMessage[],
@@ -538,6 +555,7 @@ export async function flushChatThread(
   const latestActive = await getLatestActiveTaskByContextKey(contextKey, "chat");
   const dependsOn = !immediate && latestActive ? [latestActive.id] : undefined;
   let created = 0;
+  let sourceKey: string | null = null;
   for (const match of target.matches) {
     const options: CreateTaskOptions = {
       agentId: match.agent?.id ?? null,
@@ -564,6 +582,7 @@ export async function flushChatThread(
     };
     try {
       const { task, unattached } = await createChatTaskWithFiles(description, options, inbound);
+      sourceKey ??= sessionSourceKey(task);
       created++;
       console.log(
         `[chat-sdk] ${threadId}: task ${task.id} for ${match.agent ? `agent ${match.agent.id}` : "no agent (queued)"} (${match.matchedText}, dependsOn: ${dependsOn?.join(", ") ?? "none"}${unattached.length ? `, ${unattached.length} file(s) not attached` : ""})`,
@@ -578,6 +597,14 @@ export async function flushChatThread(
       }
     }
   }
+  const label = chatSourceLabel(adapter, requester);
+  if (sourceKey && label) {
+    // Every message refreshes the label, so a renamed group shows its new title.
+    // The error may echo the label, which can hold a person's name: do not log it.
+    await rememberSessionLabel(sessionGroupKey(sourceKey), label).catch(() => {
+      console.warn("[chat-sdk] Could not save a session source label");
+    });
+  }
   if (created > 0) {
     await rememberChatThreadRequester(threadId, requester.userId);
     await subscribe(thread);

package/src/kv-reserved-namespaces.ts

@@ -12,8 +12,20 @@ const RESERVED_FAMILIES = new Map([
   ["worker", "namespace is reserved for worker nudges"],
   // Durable dedupe for SLACK_BLOCK_EXTERNAL_CHANNELS alerts (src/slack/external-channel.ts).
   ["slack-external-alert", "namespace is reserved for Slack external channel alerts"],
+  // Source group labels (src/be/db/session-labels.ts). Private, see PRIVATE_FAMILIES.
+  [
+    "session-labels",
+    "namespace is reserved for session source labels; GET /api/session-tree returns them",
+  ],
 ]);
 
+/**
+ * Reserved families that generic KV callers may not read either. Their rows
+ * hold data that another route returns only to callers with access (a
+ * source label names a private channel or a DM partner).
+ */
+const PRIVATE_FAMILIES = new Set(["session-labels"]);
+
 export function isReservedNamespace(namespace: string): boolean {
   return reservedNamespaceError(namespace) !== null;
 }
@@ -22,6 +34,13 @@ export function reservedNamespaceError(namespace: string): string | null {
   return RESERVED_FAMILIES.get(namespace.split(":", 1)[0] ?? "") ?? null;
 }
 
+/** The error a generic KV read of a private family gets, or null. */
+export function privateNamespaceError(namespace: string): string | null {
+  return PRIVATE_FAMILIES.has(namespace.split(":", 1)[0] ?? "")
+    ? reservedNamespaceError(namespace)
+    : null;
+}
+
 export function reservedRoomKeyError(key: string): string | null {
   return key.startsWith("_room/")
     ? "room snapshot keys are reserved; use the room endpoints"

package/src/providers/acp-targets.ts

@@ -359,7 +359,7 @@ const copilotTargetProfile: AcpTargetProfile = {
   },
 };
 
-/** Qwen Code's `--auth-type` choices (0.26.0). `qwen-oauth` needs a browser, so it is left out. */
+/** Qwen Code's `--auth-type` choices (0.26.1). `qwen-oauth` needs a browser, so it is left out. */
 const QWEN_AUTH_TYPES = ["openai", "openai-responses", "anthropic", "gemini", "vertex-ai"] as const;
 
 // Qwen Code is a Gemini CLI fork: QWEN_SYSTEM_MD replaces its built-in prompt

package/src/providers/amp-adapter.ts

@@ -45,7 +45,7 @@ import type {
  * default; the image installs exactly this version and the per-task settings
  * set `amp.updates.mode: "disabled"`. Bump it deliberately, with a live run.
  */
-export const AMP_PACKAGE = "@ampcode/cli@0.0.1792844927-g360c96";
+export const AMP_PACKAGE = "@ampcode/cli@0.0.1792929650-g000512";
 
 /** MCP server name. Amp exposes its tools as `agent_swarm` / `store_progress` (dashes become underscores). */
 const AMP_MCP_SERVER_NAME = "agent-swarm";

package/src/providers/claude-adapter.ts

@@ -1445,7 +1445,11 @@ export class ClaudeAdapter implements ProviderAdapter {
     // (headless) or block on the trust dialog (tmux), so seed trust for every session.
     if (isEnvFlagEnabled("CLAUDE_TRUST_PRESEED", true, sourceEnv)) {
       try {
-        await preseedClaudeTrustDialog(await resolveClaudeTrustDirs(config.cwd));
+        // Seed the ~/.claude.json the CLI reads: its HOME comes from the session env.
+        await preseedClaudeTrustDialog(
+          await resolveClaudeTrustDirs(config.cwd),
+          sourceEnv.HOME || undefined,
+        );
       } catch (err) {
         console.warn(
           `\x1b[33m[claude]\x1b[0m ${scrubSecrets(`Failed to pre-seed trust for ${config.cwd}: ${err}`)}`,

package/src/providers/claude-managed-adapter.ts

@@ -64,6 +64,7 @@ import {
   computeContextUsedUnified,
   getContextWindowSize,
 } from "../utils/context-window";
+import { selectCredential } from "../utils/credentials";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { computeClaudeManagedCostUsd } from "./claude-managed-models";
 import { getRuntimeFeePerHour } from "./claude-managed-pricing";
@@ -862,7 +863,11 @@ export class ClaudeManagedAdapter implements ProviderAdapter {
       );
     }
 
-    this.apiKey = process.env.ANTHROPIC_API_KEY as string;
+    this.apiKey = selectCredential(
+      process.env.ANTHROPIC_API_KEY as string,
+      undefined,
+      "ANTHROPIC_API_KEY",
+    ).selected;
     this.agentId = process.env.MANAGED_AGENT_ID as string;
     this.environmentId = process.env.MANAGED_ENVIRONMENT_ID as string;
 
@@ -879,6 +884,14 @@ export class ClaudeManagedAdapter implements ProviderAdapter {
   }
 
   async createSession(config: ProviderSessionConfig): Promise<ProviderSession> {
+    // Keep the runner's task selection instead of the container's pool.
+    const taskKey = config.env?.ANTHROPIC_API_KEY;
+    const client =
+      taskKey && this.client instanceof Anthropic
+        ? this.client.withOptions({
+            apiKey: selectCredential(taskKey, undefined, "ANTHROPIC_API_KEY").selected,
+          })
+        : this.client;
     // Native resume is deprecated. Follow-up continuity is delivered via the
     // context preamble (see src/commands/context-preamble.ts). Any stray
     // resumeSessionId is logged and ignored — we always create a fresh session.
@@ -942,16 +955,10 @@ export class ClaudeManagedAdapter implements ProviderAdapter {
     if (vaultIds.length > 0) {
       createParams.vault_ids = Array.from(new Set(vaultIds));
     }
-    const created = await Promise.resolve(this.client.beta.sessions.create(createParams));
+    const created = await Promise.resolve(client.beta.sessions.create(createParams));
     const sessionId = created.id;
 
-    return new ClaudeManagedSession(
-      this.client,
-      sessionId,
-      config,
-      userMessageContent,
-      seenEventIds,
-    );
+    return new ClaudeManagedSession(client, sessionId, config, userMessageContent, seenEventIds);
   }
 
   /**

package/src/providers/codex-adapter.ts

@@ -30,6 +30,13 @@
 
 import { existsSync as nodeExistsSync } from "node:fs";
 import { join } from "node:path";
+import {
+  CODEX_GATEWAY_API_KEY,
+  deriveDefaultRoute,
+  type ModelRoute,
+  routeCredentialStatus,
+  routeUnsetEnv,
+} from "@desplega/model-routing";
 import { buildRatingsFromLlm, fetchRetrievalsForTask, postRatings } from "../be/memory/raters/llm";
 import { contextBoundNoteThreshold, createContextBoundNote } from "../hooks/context-bound-note";
 import { getApiKey } from "../utils/api-key";
@@ -38,6 +45,7 @@ import {
   clampContextPercent,
   computeContextUsedUnified,
 } from "../utils/context-window";
+import { selectCredential } from "../utils/credentials";
 import { isEnvFlagEnabled, isSessionSummarySkipped } from "../utils/env-flag";
 import { SessionErrorTracker } from "../utils/error-tracker";
 import { summarizeSession as runSummarize } from "../utils/internal-ai";
@@ -82,6 +90,32 @@ import type {
 
 type CodexConfig = Record<string, CodexConfigValue | undefined>;
 
+/** `model_provider` id of the generated gateway block. */
+const CODEX_GATEWAY_PROVIDER_ID = "swarm-gateway";
+
+/**
+ * Config overrides that send Codex through the gateway route. Codex 0.164
+ * ignores `OPENAI_BASE_URL` and env keys for its built-in `openai` provider, so
+ * the gateway needs its own provider block. Verified on 0.164 against a local
+ * gateway: Codex sends `Authorization: Bearer $CODEX_GATEWAY_API_KEY` to
+ * `<base_url>/responses` and never the auth.json OAuth token. `wire_api`
+ * defaults to `responses` (`chat` is rejected); it is set to state intent.
+ */
+export function codexGatewayConfig(route: ModelRoute): CodexConfig {
+  return {
+    model_provider: CODEX_GATEWAY_PROVIDER_ID,
+    model_providers: {
+      [CODEX_GATEWAY_PROVIDER_ID]: {
+        name: "Swarm gateway",
+        base_url: route.baseUrl,
+        env_key: CODEX_GATEWAY_API_KEY,
+        wire_api: "responses",
+        requires_openai_auth: false,
+      },
+    },
+  };
+}
+
 /** Plugin id the worker image installs (`codex plugin add context-mode@context-mode`). */
 const CONTEXT_MODE_CODEX_PLUGIN = "context-mode@context-mode";
 
@@ -187,7 +221,10 @@ export type CodexThreadFactory = (options: {
 }) => Promise<CodexThread> | CodexThread;
 
 /**
- * Codex satisfies its credential requirement by ANY of:
+ * A gateway route (`CODEX_GATEWAY_BASE_URL` + `CODEX_GATEWAY_API_KEY`) wins
+ * and alone decides readiness: a gateway URL without its key is not ready,
+ * whatever OAuth or auth.json is present. Otherwise Codex satisfies its
+ * credential requirement by ANY of:
  *   1. `~/.codex/auth.json` already exists on disk (the canonical state once
  *      `codex login` has run).
  *   2. `OPENAI_API_KEY` is set — the entrypoint will run
@@ -204,6 +241,13 @@ export function checkCodexCredentials(
   env: Record<string, string | undefined>,
   opts: CredCheckOptions = {},
 ): CredStatus {
+  const gateway = deriveDefaultRoute("codex", env);
+  if (gateway) {
+    const status = routeCredentialStatus(gateway, env);
+    return status.ready
+      ? { ready: true, missing: [], satisfiedBy: "env", hint: status.hint }
+      : { ready: false, missing: status.missing, hint: status.hint };
+  }
   const homeDir = opts.homeDir ?? env.HOME ?? "/root";
   const existsSync = opts.fs?.existsSync ?? nodeExistsSync;
   const authFile = `${homeDir}/.codex/auth.json`;
@@ -1965,14 +2009,21 @@ export async function createInProcessCodexSession(
     preSessionEvents.push(event);
   };
 
-  const mergedConfig = await buildCodexConfig(config, resolvedModel, bufferedEmit);
+  const routeEnv = config.env ?? process.env;
+  const gateway = deriveDefaultRoute("codex", routeEnv);
+  const mergedConfig = {
+    ...(await buildCodexConfig(config, resolvedModel, bufferedEmit)),
+    ...(gateway ? codexGatewayConfig(gateway) : {}),
+  };
 
   // Auth resolution. `codex_oauth` (in the swarm config store) wins over
   // `OPENAI_API_KEY` so users can keep an OpenAI key set for embeddings
   // without it shadowing their ChatGPT login. The entrypoint already runs
   // this same precedence at boot — this block handles local dev (where
   // the entrypoint didn't run) and any case where auth.json is stale.
-  const authMode = await resolveCodexAuthMode(config, bufferedEmit);
+  // A gateway route skips it: no OAuth is restored for a session whose traffic
+  // goes to the gateway.
+  const authMode = gateway ? null : await resolveCodexAuthMode(config, bufferedEmit);
 
   // The app-server receives an explicit environment. Construct a
   // minimal env explicitly so the spawned Codex CLI can find its binary
@@ -1999,7 +2050,14 @@ export async function createInProcessCodexSession(
     ...buildOtelTraceparentEnv(config.env ?? process.env),
     SWARM_CODEX_APP_SERVER: "1",
   };
-  if (authMode === "chatgpt") delete env.OPENAI_API_KEY;
+  if (gateway) {
+    for (const key of routeUnsetEnv("codex", gateway)) delete env[key];
+    const gatewayKey = routeEnv[CODEX_GATEWAY_API_KEY];
+    if (gatewayKey) env[CODEX_GATEWAY_API_KEY] = gatewayKey;
+  } else if (authMode === "chatgpt") delete env.OPENAI_API_KEY;
+  else if (env.OPENAI_API_KEY) {
+    env.OPENAI_API_KEY = selectCredential(env.OPENAI_API_KEY, undefined, "OPENAI_API_KEY").selected;
+  }
 
   const codexPathOverride = process.env.CODEX_PATH_OVERRIDE;
 
@@ -2151,6 +2209,11 @@ class CodexSubprocessSession implements ProviderSession {
     };
 
     const apiKey = getApiKey();
+    const providerKeys: Record<string, string> = {};
+    for (const keyVar of ["OPENAI_API_KEY", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY"]) {
+      const value = config.env?.[keyVar] ?? process.env[keyVar];
+      if (value) providerKeys[keyVar] = selectCredential(value, undefined, keyVar).selected;
+    }
 
     this.proc = registerProcessGroup(
       Bun.spawn(argv, {
@@ -2168,13 +2231,7 @@ class CodexSubprocessSession implements ProviderSession {
           ...(process.env.MCP_BASE_URL ? { MCP_BASE_URL: process.env.MCP_BASE_URL } : {}),
           ...(apiKey ? { AGENT_SWARM_API_KEY: apiKey, API_KEY: apiKey } : {}),
           // Embedding / summarization paths read these:
-          ...(process.env.OPENAI_API_KEY ? { OPENAI_API_KEY: process.env.OPENAI_API_KEY } : {}),
-          ...(process.env.OPENROUTER_API_KEY
-            ? { OPENROUTER_API_KEY: process.env.OPENROUTER_API_KEY }
-            : {}),
-          ...(process.env.ANTHROPIC_API_KEY
-            ? { ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY }
-            : {}),
+          ...providerKeys,
           ...(process.env.CODEX_PATH_OVERRIDE
             ? { CODEX_PATH_OVERRIDE: process.env.CODEX_PATH_OVERRIDE }
             : {}),
@@ -2475,6 +2532,9 @@ export class CodexAdapter implements ProviderAdapter {
   }
 
   async createSession(config: ProviderSessionConfig): Promise<ProviderSession> {
+    if (deriveDefaultRoute("codex", config.env ?? process.env)) {
+      console.log("\x1b[2m[codex]\x1b[0m Using credential: gateway");
+    }
     if (this.bypassSubprocess) {
       return createInProcessCodexSession(config, {
         skillsDir: this.skillsDir,

package/src/scheduler/scheduler.ts

@@ -91,8 +91,9 @@ async function executeScheduleScript(schedule: ScheduledTask): Promise<void> {
     agentId,
     scriptName: schedule.scriptName,
     // A pointer, not a copy: script schedules fire as often as every minute and
-    // script_runs has no retention sweep, so copying the source on every fire
-    // would grow the table by tens of MB a day. script_versions keeps the text.
+    // script_runs retention (SCRIPT_RUNS_RETENTION_DAYS) is off by default, so
+    // copying the source on every fire would grow the table by tens of MB a
+    // day. script_versions keeps the text.
     source: `// Scheduled run of '${script.name}' v${script.version} (global, contentHash ${script.contentHash}) by schedule '${schedule.name}'.\n// Full source: script_versions row for this version.\n`,
     args,
     startedAt: new Date().toISOString(),

package/src/scripts-runtime/swarm-sdk.ts

@@ -319,7 +319,13 @@ function bridgeRequestFor(name: string, args: unknown): BridgeRequest | null {
     case "workflow_getRun": {
       const id = typeof body.id === "string" ? body.id : undefined;
       if (!id) throw new Error("workflow_getRun requires string `id`");
-      return { method: "GET", path: `/api/workflow-runs/${encodeURIComponent(id)}` };
+      if (body.fields !== undefined && body.fields !== "full" && body.fields !== "slim") {
+        throw new Error('workflow_getRun `fields` must be "full" or "slim"');
+      }
+      return {
+        method: "GET",
+        path: appendQuery(`/api/workflow-runs/${encodeURIComponent(id)}`, { fields: body.fields }),
+      };
     }
     case "workflow_delete": {
       const id = typeof body.id === "string" ? body.id : undefined;

package/src/scripts-runtime/types/stdlib.d.ts

@@ -378,7 +378,7 @@ declare module "swarm-sdk" {
       limit?: number;
       offset?: number;
     }): Promise<unknown>;
-    workflow_getRun(args: { id: string }): Promise<unknown>;
+    workflow_getRun(args: { id: string; fields?: "full" | "slim" }): Promise<unknown>;
     // --- prompt templates ---
     prompt_list(args?: {
       eventType?: string;

package/src/scripts-runtime/types/swarm-extension.d.ts

@@ -9,16 +9,16 @@ declare module "swarm-extension" {
       | "schedule"
       | "slack"
       | "agentmail"
-      | "mcp"
-      | "api"
-      | "ui"
       | "github"
       | "gitlab"
       | "azure-devops"
       | "bitbucket"
-      | "system"
       | "linear"
       | "jira"
+      | "mcp"
+      | "api"
+      | "ui"
+      | "system"
       | "comb"
       | "chat"
       | undefined;
@@ -127,16 +127,16 @@ declare module "swarm-extension" {
       | "schedule"
       | "slack"
       | "agentmail"
-      | "mcp"
-      | "api"
-      | "ui"
       | "github"
       | "gitlab"
       | "azure-devops"
       | "bitbucket"
-      | "system"
       | "linear"
       | "jira"
+      | "mcp"
+      | "api"
+      | "ui"
+      | "system"
       | "comb"
       | "chat";
     tags: string[];
@@ -401,6 +401,15 @@ declare module "swarm-extension" {
     description: string;
     origin: TaskCreateOrigin;
     requestInfo?: RequestInfo;
+    /** Slack ingress metadata; not persisted or writable through modify. */
+    slack?: {
+      trigger: "mention" | "thread-buffer";
+      messages: {
+        ts: string;
+        userId: string;
+        text: string;
+      }[];
+    };
   }
   /** A pre.task.create hook blocked a task before it was created. */
   export interface TaskBlockedEvent {

package/src/scripts-runtime/types/swarm-sdk.d.ts

@@ -360,7 +360,7 @@ declare module "swarm-sdk" {
       limit?: number;
       offset?: number;
     }): Promise<unknown>;
-    workflow_getRun(args: { id: string }): Promise<unknown>;
+    workflow_getRun(args: { id: string; fields?: "full" | "slim" }): Promise<unknown>;
     // --- prompt templates ---
     prompt_list(args?: {
       eventType?: string;