@desplega.ai/agent-swarm 2.5.4 → 2.7.0

package/src/providers/codex-adapter.ts

@@ -30,6 +30,13 @@
 
 import { existsSync as nodeExistsSync } from "node:fs";
 import { join } from "node:path";
+import {
+  CODEX_GATEWAY_API_KEY,
+  deriveDefaultRoute,
+  type ModelRoute,
+  routeCredentialStatus,
+  routeUnsetEnv,
+} from "@desplega/model-routing";
 import { buildRatingsFromLlm, fetchRetrievalsForTask, postRatings } from "../be/memory/raters/llm";
 import { contextBoundNoteThreshold, createContextBoundNote } from "../hooks/context-bound-note";
 import { getApiKey } from "../utils/api-key";
@@ -38,6 +45,7 @@ import {
   clampContextPercent,
   computeContextUsedUnified,
 } from "../utils/context-window";
+import { selectCredential } from "../utils/credentials";
 import { isEnvFlagEnabled, isSessionSummarySkipped } from "../utils/env-flag";
 import { SessionErrorTracker } from "../utils/error-tracker";
 import { summarizeSession as runSummarize } from "../utils/internal-ai";
@@ -82,6 +90,32 @@ import type {
 
 type CodexConfig = Record<string, CodexConfigValue | undefined>;
 
+/** `model_provider` id of the generated gateway block. */
+const CODEX_GATEWAY_PROVIDER_ID = "swarm-gateway";
+
+/**
+ * Config overrides that send Codex through the gateway route. Codex 0.164
+ * ignores `OPENAI_BASE_URL` and env keys for its built-in `openai` provider, so
+ * the gateway needs its own provider block. Verified on 0.164 against a local
+ * gateway: Codex sends `Authorization: Bearer $CODEX_GATEWAY_API_KEY` to
+ * `<base_url>/responses` and never the auth.json OAuth token. `wire_api`
+ * defaults to `responses` (`chat` is rejected); it is set to state intent.
+ */
+export function codexGatewayConfig(route: ModelRoute): CodexConfig {
+  return {
+    model_provider: CODEX_GATEWAY_PROVIDER_ID,
+    model_providers: {
+      [CODEX_GATEWAY_PROVIDER_ID]: {
+        name: "Swarm gateway",
+        base_url: route.baseUrl,
+        env_key: CODEX_GATEWAY_API_KEY,
+        wire_api: "responses",
+        requires_openai_auth: false,
+      },
+    },
+  };
+}
+
 /** Plugin id the worker image installs (`codex plugin add context-mode@context-mode`). */
 const CONTEXT_MODE_CODEX_PLUGIN = "context-mode@context-mode";
 
@@ -187,7 +221,10 @@ export type CodexThreadFactory = (options: {
 }) => Promise<CodexThread> | CodexThread;
 
 /**
- * Codex satisfies its credential requirement by ANY of:
+ * A gateway route (`CODEX_GATEWAY_BASE_URL` + `CODEX_GATEWAY_API_KEY`) wins
+ * and alone decides readiness: a gateway URL without its key is not ready,
+ * whatever OAuth or auth.json is present. Otherwise Codex satisfies its
+ * credential requirement by ANY of:
  *   1. `~/.codex/auth.json` already exists on disk (the canonical state once
  *      `codex login` has run).
  *   2. `OPENAI_API_KEY` is set — the entrypoint will run
@@ -204,6 +241,13 @@ export function checkCodexCredentials(
   env: Record<string, string | undefined>,
   opts: CredCheckOptions = {},
 ): CredStatus {
+  const gateway = deriveDefaultRoute("codex", env);
+  if (gateway) {
+    const status = routeCredentialStatus(gateway, env);
+    return status.ready
+      ? { ready: true, missing: [], satisfiedBy: "env", hint: status.hint }
+      : { ready: false, missing: status.missing, hint: status.hint };
+  }
   const homeDir = opts.homeDir ?? env.HOME ?? "/root";
   const existsSync = opts.fs?.existsSync ?? nodeExistsSync;
   const authFile = `${homeDir}/.codex/auth.json`;
@@ -1965,14 +2009,21 @@ export async function createInProcessCodexSession(
     preSessionEvents.push(event);
   };
 
-  const mergedConfig = await buildCodexConfig(config, resolvedModel, bufferedEmit);
+  const routeEnv = config.env ?? process.env;
+  const gateway = deriveDefaultRoute("codex", routeEnv);
+  const mergedConfig = {
+    ...(await buildCodexConfig(config, resolvedModel, bufferedEmit)),
+    ...(gateway ? codexGatewayConfig(gateway) : {}),
+  };
 
   // Auth resolution. `codex_oauth` (in the swarm config store) wins over
   // `OPENAI_API_KEY` so users can keep an OpenAI key set for embeddings
   // without it shadowing their ChatGPT login. The entrypoint already runs
   // this same precedence at boot — this block handles local dev (where
   // the entrypoint didn't run) and any case where auth.json is stale.
-  const authMode = await resolveCodexAuthMode(config, bufferedEmit);
+  // A gateway route skips it: no OAuth is restored for a session whose traffic
+  // goes to the gateway.
+  const authMode = gateway ? null : await resolveCodexAuthMode(config, bufferedEmit);
 
   // The app-server receives an explicit environment. Construct a
   // minimal env explicitly so the spawned Codex CLI can find its binary
@@ -1999,7 +2050,14 @@ export async function createInProcessCodexSession(
     ...buildOtelTraceparentEnv(config.env ?? process.env),
     SWARM_CODEX_APP_SERVER: "1",
   };
-  if (authMode === "chatgpt") delete env.OPENAI_API_KEY;
+  if (gateway) {
+    for (const key of routeUnsetEnv("codex", gateway)) delete env[key];
+    const gatewayKey = routeEnv[CODEX_GATEWAY_API_KEY];
+    if (gatewayKey) env[CODEX_GATEWAY_API_KEY] = gatewayKey;
+  } else if (authMode === "chatgpt") delete env.OPENAI_API_KEY;
+  else if (env.OPENAI_API_KEY) {
+    env.OPENAI_API_KEY = selectCredential(env.OPENAI_API_KEY, undefined, "OPENAI_API_KEY").selected;
+  }
 
   const codexPathOverride = process.env.CODEX_PATH_OVERRIDE;
 
@@ -2151,6 +2209,11 @@ class CodexSubprocessSession implements ProviderSession {
     };
 
     const apiKey = getApiKey();
+    const providerKeys: Record<string, string> = {};
+    for (const keyVar of ["OPENAI_API_KEY", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY"]) {
+      const value = config.env?.[keyVar] ?? process.env[keyVar];
+      if (value) providerKeys[keyVar] = selectCredential(value, undefined, keyVar).selected;
+    }
 
     this.proc = registerProcessGroup(
       Bun.spawn(argv, {
@@ -2168,13 +2231,7 @@ class CodexSubprocessSession implements ProviderSession {
           ...(process.env.MCP_BASE_URL ? { MCP_BASE_URL: process.env.MCP_BASE_URL } : {}),
           ...(apiKey ? { AGENT_SWARM_API_KEY: apiKey, API_KEY: apiKey } : {}),
           // Embedding / summarization paths read these:
-          ...(process.env.OPENAI_API_KEY ? { OPENAI_API_KEY: process.env.OPENAI_API_KEY } : {}),
-          ...(process.env.OPENROUTER_API_KEY
-            ? { OPENROUTER_API_KEY: process.env.OPENROUTER_API_KEY }
-            : {}),
-          ...(process.env.ANTHROPIC_API_KEY
-            ? { ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY }
-            : {}),
+          ...providerKeys,
           ...(process.env.CODEX_PATH_OVERRIDE
             ? { CODEX_PATH_OVERRIDE: process.env.CODEX_PATH_OVERRIDE }
             : {}),
@@ -2475,6 +2532,9 @@ export class CodexAdapter implements ProviderAdapter {
   }
 
   async createSession(config: ProviderSessionConfig): Promise<ProviderSession> {
+    if (deriveDefaultRoute("codex", config.env ?? process.env)) {
+      console.log("\x1b[2m[codex]\x1b[0m Using credential: gateway");
+    }
     if (this.bypassSubprocess) {
       return createInProcessCodexSession(config, {
         skillsDir: this.skillsDir,

package/src/providers/dsh-adapter.ts

@@ -37,7 +37,7 @@ import type {
 } from "./types";
 
 // npm's `latest` is older and lacks the JSON/stdin contract used here.
-export const DSH_PACKAGE = "@deepseek-ai/dsh@0.2.1-rc.3";
+export const DSH_PACKAGE = "@deepseek-ai/dsh@0.2.1-rc.4";
 
 export function checkDshCredentials(env: Record<string, string | undefined>): CredStatus {
   return env.DEEPSEEK_API_KEY?.trim() || env.OPENROUTER_API_KEY?.trim()

package/src/providers/pi-mono-adapter.ts

@@ -382,14 +382,15 @@ type ToolStructuredContent = NonNullable<AgentToolResult["structuredContent"]>;
 export const SWARM_TOOL_NAMESPACE = { name: "agent-swarm" } as const;
 
 /**
- * `PI_TOOL_DEFERRAL`: hide non-core swarm tools behind pi's `tool_search`.
- * Off by default until a pilot measures the prompt-cache cost of mid-session
- * tool-set changes. Read from `process.env` by both the adapter traits (which
- * pick the prompt's tool-discovery line) and `createSession`, so the prompt
- * and the session always agree.
+ * `PI_TOOL_DEFERRAL`: hide non-core swarm tools, and installed MCP server
+ * tools, behind pi's `tool_search`. On by default: the deferred schemas cost
+ * more on every request than the one partial cache miss a load causes.
+ * `false` declares every tool up front. Read from `process.env` by both the
+ * adapter traits (which pick the prompt's tool-discovery line) and
+ * `createSession`, so the prompt and the session always agree.
  */
 export function isPiToolDeferralEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
-  return parseEnvFlag(env.PI_TOOL_DEFERRAL, false);
+  return parseEnvFlag(env.PI_TOOL_DEFERRAL, true);
 }
 
 /**
@@ -919,6 +920,28 @@ function requestContextTokens(message: unknown): number | undefined {
   return usage.input + cacheRead + cacheWrite;
 }
 
+/**
+ * The session-log line for one LLM call's usage (token counts only, never
+ * content). The dashboard reads it as that call's cache-hit chip.
+ */
+function callUsageLine(message: unknown): string | undefined {
+  const usage = (message as { usage?: Record<string, unknown> } | null)?.usage;
+  if (typeof usage?.input !== "number") return undefined;
+  const count = (value: unknown) =>
+    typeof value === "number" && Number.isFinite(value) ? value : 0;
+  return JSON.stringify({
+    type: "call_usage",
+    harness: "pi",
+    usage: {
+      input: count(usage.input),
+      cacheRead: count(usage.cacheRead),
+      cacheWrite: count(usage.cacheWrite),
+      output: count(usage.output),
+      reasoning: count(usage.reasoning),
+    },
+  });
+}
+
 function describeAssistantTurn(message: unknown): AssistantTurnShape {
   const msg = (message ?? {}) as {
     content?: unknown;
@@ -1116,6 +1139,10 @@ export class PiMonoSession implements ProviderSession {
         if (endMsg.role === "assistant") {
           const turn = describeAssistantTurn(event.message);
           this.lastAssistantTurn = turn;
+          // Ahead of the turn's text and tool lines: the chip rides on the
+          // call's first row.
+          const usageLine = callUsageLine(event.message);
+          if (usageLine) this.emit({ type: "raw_log", content: usageLine });
           if (endMsg.stopReason === "error") {
             // Candidate terminal failure. May still be cleared by a successful
             // retry (auto_retry_end success / a later good message_end).
@@ -1684,12 +1711,15 @@ function escapeValues(values: unknown): Record<string, string> {
 /**
  * Map installed servers (`fetchInstalledMcpServers(..., "claude")` entries)
  * to pi MCP configs. pi speaks stdio and streamable HTTP; `sse` entries map to
- * HTTP, which is how the previous pi client already reached them. Tools stay
- * `direct`, as before: the prompt lists these servers as in the tool list.
+ * HTTP, which is how the previous pi client already reached them. With
+ * `deferred`, their tools load through `tool_search` like non-core swarm
+ * tools; otherwise they are declared up front.
  */
 export function toPiMcpServers(
   installed: Record<string, Record<string, unknown>> | null,
+  options: { deferred?: boolean } = {},
 ): Record<string, McpServerConfig> {
+  const exposure = options.deferred ? "deferred" : "direct";
   const servers: Record<string, McpServerConfig> = {};
   for (const [name, entry] of Object.entries(installed ?? {})) {
     if (typeof entry.command === "string") {
@@ -1698,14 +1728,14 @@ export function toPiMcpServers(
         command: entry.command,
         args: Array.isArray(entry.args) ? entry.args.map(String) : [],
         env: escapeValues(entry.env),
-        exposure: "direct",
+        exposure,
       };
     } else if (typeof entry.url === "string") {
       servers[name] = {
         type: "http",
         url: entry.url,
         headers: escapeValues(entry.headers),
-        exposure: "direct",
+        exposure,
       };
     }
   }
@@ -1860,7 +1890,7 @@ export class PiMonoAdapter implements ProviderAdapter {
       config.apiUrl && config.apiKey && config.agentId
         ? await fetchInstalledMcpServers(config.apiUrl, config.apiKey, config.agentId, "claude")
         : null;
-    const piMcpServers = toPiMcpServers(installedMcpServers);
+    const piMcpServers = toPiMcpServers(installedMcpServers, { deferred: deferTools });
     if (Object.keys(piMcpServers).length > 0) {
       console.log(
         `\x1b[2m[${config.role}]\x1b[0m Registering ${Object.keys(piMcpServers).length} installed MCP server(s) with pi`,

package/src/scheduler/scheduler.ts

@@ -75,7 +75,7 @@ function resolveExecutorRegistry(): ExecutorRegistry | null {
  * scripts-runtime — no agent/LLM in the loop. Reuses the same `runScriptWithRunCredential()`
  * path as the `swarm-script` workflow executor.
  */
-async function executeScheduleScript(schedule: ScheduledTask): Promise<void> {
+export async function executeScheduleScript(schedule: ScheduledTask): Promise<void> {
   if (!schedule.scriptName) {
     throw new Error(`Schedule "${schedule.name}" has no scriptName (targetType=script)`);
   }
@@ -91,8 +91,9 @@ async function executeScheduleScript(schedule: ScheduledTask): Promise<void> {
     agentId,
     scriptName: schedule.scriptName,
     // A pointer, not a copy: script schedules fire as often as every minute and
-    // script_runs has no retention sweep, so copying the source on every fire
-    // would grow the table by tens of MB a day. script_versions keeps the text.
+    // script_runs retention (SCRIPT_RUNS_RETENTION_DAYS) is off by default, so
+    // copying the source on every fire would grow the table by tens of MB a
+    // day. script_versions keeps the text.
     source: `// Scheduled run of '${script.name}' v${script.version} (global, contentHash ${script.contentHash}) by schedule '${schedule.name}'.\n// Full source: script_versions row for this version.\n`,
     args,
     startedAt: new Date().toISOString(),
@@ -105,6 +106,7 @@ async function executeScheduleScript(schedule: ScheduledTask): Promise<void> {
       source: script.source,
       args,
       fsMode: "none",
+      executor: script.executor,
       agentId,
       egressSecrets: credentials.egressSecrets,
       userConfig: credentials.userConfig,

package/src/scripts-runtime/eval-harness.ts

@@ -1,6 +1,7 @@
 import { buildCtx } from "./ctx";
 import { patchFetchWithEgressSubstitution } from "./egress-secrets";
 import type { SwarmConfigPayload } from "./executors/types";
+import { isHostValidationEquivalent } from "./host-validated-args";
 import { ctxSignatureHintFor } from "./script-error-hints";
 import { SwarmConfig } from "./swarm-config";
 
@@ -131,8 +132,14 @@ try {
     );
   }
 
+  const hostValidatedArgs = process.env.SWARM_SCRIPT_HOST_VALIDATED_ARGS === "1";
   let validatedArgs = parsedArgs;
-  if (mod.argsSchema && typeof mod.argsSchema === "object" && "parse" in mod.argsSchema) {
+  if (
+    mod.argsSchema &&
+    typeof mod.argsSchema === "object" &&
+    "parse" in mod.argsSchema &&
+    !(hostValidatedArgs && isHostValidationEquivalent(mod.argsSchema, parsedArgs))
+  ) {
     try {
       // biome-ignore lint/suspicious/noExplicitAny: argsSchema is a Zod schema at runtime
       validatedArgs = (mod.argsSchema as any).parse(parsedArgs);

package/src/scripts-runtime/executors/native.ts

@@ -173,23 +173,21 @@ export class NativeScriptExecutor implements ScriptExecutor {
     let removeAbortListener: (() => void) | undefined;
     let proc: Bun.Subprocess<"pipe", "pipe", "pipe"> | undefined;
 
-    try {
-      if (killed) {
-        return {
-          result: undefined,
-          stdout: "",
-          stderr: "",
-          truncated: { stdout: false, stderr: false },
-          durationMs: Date.now() - start,
-          exitCode: 1,
-          error: "killed",
-        };
-      }
+    const killedOutput = (): ExecutorOutput => ({
+      result: undefined,
+      stdout: "",
+      stderr: "",
+      truncated: { stdout: false, stderr: false },
+      durationMs: Date.now() - start,
+      exitCode: 1,
+      error: "killed",
+    });
 
-      await Bun.write(argsFile, JSON.stringify(input.args ?? null));
-      await Bun.write(sourceFile, input.source);
-      await writeBareImportShims(tmpdir);
+    try {
+      if (killed) return killedOutput();
 
+      // Listen before the first await: an abort during the file writes below
+      // must stop the spawn, not land between the writes and the listener.
       const onExternalAbort = () => {
         killed = true;
         if (proc) void terminateProcessGroup(proc.pid);
@@ -197,12 +195,19 @@ export class NativeScriptExecutor implements ScriptExecutor {
       input.signal?.addEventListener("abort", onExternalAbort, { once: true });
       removeAbortListener = () => input.signal?.removeEventListener("abort", onExternalAbort);
 
+      await Bun.write(argsFile, JSON.stringify(input.args ?? null));
+      await Bun.write(sourceFile, input.source);
+      await writeBareImportShims(tmpdir);
+
+      // No await between this check and the spawn below.
+      if (killed) return killedOutput();
+
       const timeout = setTimeout(() => {
         timedOut = true;
         if (proc) void terminateProcessGroup(proc.pid);
       }, input.resources.wallClockMs);
 
-      const harnessEnv = {
+      const harnessEnv: Record<string, string> = {
         PATH: process.env.PATH ?? "/usr/bin:/bin",
         HOME: process.env.HOME ?? "/tmp",
         LANG: process.env.LANG ?? "C.UTF-8",
@@ -214,6 +219,7 @@ export class NativeScriptExecutor implements ScriptExecutor {
         SWARM_SCRIPT_RESULT_FILE: resultFile,
         SWARM_SCRIPT_ERROR_FILE: errorFile,
         SWARM_SCRIPT_STARTED_FILE: startedFile,
+        ...(input.hostValidatedArgs ? { SWARM_SCRIPT_HOST_VALIDATED_ARGS: "1" } : {}),
       };
 
       proc = registerProcessGroup(

package/src/scripts-runtime/executors/quickjs-prelude.ts

@@ -308,14 +308,116 @@ define("__swarm_ctx", ctx);
  * zod `argsSchema` check, the same contract as `eval-harness.ts`.
  */
 export const SANDBOX_EPILOGUE = String.raw`(async () => {
+  const isStructuralSchemaNode = (schema) => {
+    if (!schema || typeof schema !== "object") return false;
+    const def = schema._zod && schema._zod.def;
+    if (!def || typeof def !== "object") return false;
+    if (def.coerce) return false;
+    if (Array.isArray(def.checks) && def.checks.length > 0) return false;
+    switch (def.type) {
+      case "string":
+      case "number":
+        return !def.format;
+      case "boolean":
+      case "literal":
+      case "enum":
+        return true;
+      case "optional":
+      case "nullable":
+        return isStructuralSchemaNode(def.innerType);
+      case "array":
+        return isStructuralSchemaNode(def.element);
+      case "object": {
+        const rawShape = typeof def.shape === "function" ? def.shape() : def.shape;
+        if (!rawShape || typeof rawShape !== "object") return false;
+        return Object.values(rawShape).every(isStructuralSchemaNode);
+      }
+      default:
+        return false;
+    }
+  };
+  const isHostValidationEquivalent = (schema, value) => {
+    if (!schema || typeof schema !== "object") return false;
+    const def = schema._zod && schema._zod.def;
+    if (!def || typeof def !== "object") return false;
+    if (def.coerce) return false;
+    if (Array.isArray(def.checks) && def.checks.length > 0) return false;
+    switch (def.type) {
+      case "string":
+        return typeof value === "string" && !def.format;
+      case "number":
+        return typeof value === "number" && Number.isFinite(value) && !def.format;
+      case "boolean":
+        return typeof value === "boolean";
+      case "literal": {
+        const rawValues = def.values;
+        const values = Array.isArray(rawValues)
+          ? rawValues
+          : rawValues instanceof Set
+            ? Array.from(rawValues)
+            : [];
+        return (
+          values.length > 0 &&
+          values.some((v) => v === value && typeof v !== "bigint" && typeof v !== "symbol")
+        );
+      }
+      case "enum": {
+        if (schema._zod && schema._zod.values instanceof Set) {
+          return schema._zod.values.has(value);
+        }
+        const entriesObj = def.entries && typeof def.entries === "object" ? def.entries : null;
+        if (!entriesObj) return false;
+        const entries = Object.values(entriesObj).filter(
+          (v) => !(typeof v === "string" && typeof entriesObj[v] === "number"),
+        );
+        return entries.length > 0 && entries.includes(value);
+      }
+      case "optional":
+        return value === undefined
+          ? isStructuralSchemaNode(def.innerType)
+          : isHostValidationEquivalent(def.innerType, value);
+      case "nullable":
+        return value === null
+          ? isStructuralSchemaNode(def.innerType)
+          : isHostValidationEquivalent(def.innerType, value);
+      case "array":
+        return (
+          Array.isArray(value) &&
+          isStructuralSchemaNode(def.element) &&
+          value.every((item) => isHostValidationEquivalent(def.element, item))
+        );
+      case "object": {
+        if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+        const shape = typeof def.shape === "function" ? def.shape() : def.shape;
+        if (!shape || typeof shape !== "object") return false;
+        for (const key of Object.keys(value)) {
+          if (!Object.hasOwn(shape, key)) return false;
+        }
+        for (const [key, propSchema] of Object.entries(shape)) {
+          if (!Object.hasOwn(value, key) && key in value) return false;
+          const propValue = value[key];
+          if (!isHostValidationEquivalent(propSchema, propValue)) return false;
+        }
+        return true;
+      }
+      default:
+        return false;
+    }
+  };
   const mod = globalThis.__swarm_module;
   if (!mod || typeof mod.default !== "function") {
     throw new Error(
       "Swarm script must export a default function. Script must export default async function (args, ctx): args FIRST, ctx second.",
     );
   }
+  const hostValidatedArgs = globalThis.__swarm_host_validated_args === true;
   let args = globalThis.__swarm_args;
-  if (mod.argsSchema && typeof mod.argsSchema === "object" && "parse" in mod.argsSchema) {
+  if (
+    mod.argsSchema &&
+    typeof mod.argsSchema === "object" &&
+    "parse" in mod.argsSchema &&
+    !(hostValidatedArgs && isHostValidationEquivalent(mod.argsSchema, args))
+  ) {
     try {
       args = mod.argsSchema.parse(args);
     } catch (error) {

package/src/scripts-runtime/executors/quickjs-runner.ts

@@ -29,6 +29,7 @@ import type {
 export type QuickJSJob = {
   source: string;
   args: unknown;
+  hostValidatedArgs?: boolean;
   configPayload: SwarmConfigPayload;
   resources: ScriptResourcePolicy;
   network: ExecutorInput["network"];
@@ -656,7 +657,7 @@ async function evaluateJob(
 
   let timer: ReturnType<typeof setTimeout> | undefined;
   try {
-    const init = `globalThis.__swarm_shape = ${JSON.stringify(shape)};\nglobalThis.__swarm_args = ${JSON.stringify(args)};`;
+    const init = `globalThis.__swarm_shape = ${JSON.stringify(shape)};\nglobalThis.__swarm_args = ${JSON.stringify(args)};\nglobalThis.__swarm_host_validated_args = ${Boolean(job.hostValidatedArgs)};`;
     const ok =
       evaluate(init, "swarm-init.js") &&
       evaluate(SANDBOX_WEB_SHIMS, "swarm-web-shims.js") &&

package/src/scripts-runtime/executors/quickjs.ts

@@ -146,6 +146,12 @@ export class QuickJSScriptExecutor implements ScriptExecutor {
         `quickjs worker failed to start: ${error instanceof Error ? error.message : String(error)}`,
       );
     }
+    // An abort while the worker booted fired before the listener below
+    // exists. From here to postMessage nothing awaits.
+    if (input.signal?.aborted) {
+      pool.release(slot);
+      return emptyOutput("killed");
+    }
 
     const id = ++requestSeq;
     const start = performance.now();
@@ -196,6 +202,7 @@ export class QuickJSScriptExecutor implements ScriptExecutor {
         job: {
           source: input.source,
           args: input.args,
+          ...(input.hostValidatedArgs ? { hostValidatedArgs: true } : {}),
           configPayload: input.configPayload,
           resources: input.resources,
           network: input.network,

package/src/scripts-runtime/executors/registry.ts

@@ -7,6 +7,27 @@ const EXECUTORS: Record<string, () => ScriptExecutor> = {
   quickjs: () => new QuickJSScriptExecutor(),
 };
 
+export function getDeploymentScriptExecutorName(env: NodeJS.ProcessEnv = process.env): string {
+  return (env.SCRIPT_EXECUTOR ?? "native").trim();
+}
+
+/**
+ * Operator sandbox ceiling: when the deployment sets `SCRIPT_EXECUTOR=quickjs`,
+ * individual scripts or agent calls may not escalate to the less-restricted
+ * `native` executor. When the deployment runs `native` (the default), scripts
+ * may opt down into `quickjs`.
+ */
+export function isExecutorAllowedByDeployment(
+  requested: string | null | undefined,
+  env: NodeJS.ProcessEnv = process.env,
+): boolean {
+  if (!requested) return true;
+  if (getDeploymentScriptExecutorName(env) === "quickjs" && requested.trim() === "native") {
+    return false;
+  }
+  return true;
+}
+
 export function getScriptExecutor(name = process.env.SCRIPT_EXECUTOR ?? "native"): ScriptExecutor {
   const factory = EXECUTORS[name.trim()];
   if (!factory) {
@@ -16,3 +37,14 @@ export function getScriptExecutor(name = process.env.SCRIPT_EXECUTOR ?? "native"
   }
   return factory();
 }
+
+export function resolveScriptExecutor(
+  requested?: string | null,
+  env: NodeJS.ProcessEnv = process.env,
+): ScriptExecutor {
+  if (!isExecutorAllowedByDeployment(requested, env)) {
+    throw new Error('Executor "native" is not permitted when deployment SCRIPT_EXECUTOR="quickjs"');
+  }
+  const effective = requested ?? env.SCRIPT_EXECUTOR ?? "native";
+  return getScriptExecutor(effective);
+}

package/src/scripts-runtime/executors/types.ts

@@ -3,6 +3,7 @@ import type { ScriptApiConnectionDescriptor, ScriptMcpConnectionDescriptor } fro
 import type { FailedCredentialBinding, ResolvedCredentialBinding } from "../credential-broker";
 
 export type ScriptFsMode = "none" | "workspace-rw";
+export type ScriptExecutorName = "native" | "quickjs";
 
 export type EgressSecretEntry = ResolvedCredentialBinding;
 
@@ -49,6 +50,12 @@ export type ScriptResourcePolicy = {
 export type ExecutorInput = {
   source: string;
   args: unknown;
+  /**
+   * Trusted host-only flag indicating `args` already passed host JSON Schema
+   * validation for this run. Executors may skip `argsSchema.parse(args)` only
+   * when this flag is true AND the runtime `argsSchema` is purely structural.
+   */
+  hostValidatedArgs?: boolean;
   configPayload: SwarmConfigPayload;
   resources: ScriptResourcePolicy;
   fsMode: ScriptFsMode;