@desplega.ai/agent-swarm 2.7.4 → 2.7.5

package/src/be/pricing-normalize.ts

@@ -40,8 +40,9 @@ const ROUTING_PREFIXES_BY_PROVIDER: Record<PricingProvider, readonly string[]> =
   // openai, … — strip whichever proxy prefix the user picked.
   opencode: ["openrouter/", "github-copilot/"],
   // pi-mono can hit openrouter mirrors, the github-copilot proxy, or native
-  // anthropic/openai/google providers.
-  pi: ["openrouter/", "github-copilot/"],
+  // anthropic/openai/google providers. `openai-codex/<id>` is an OpenAI id
+  // served by the ChatGPT subscription pool, priced like codex on that pool.
+  pi: ["openrouter/", "github-copilot/", "openai-codex/"],
   // codex normally reports a bare id, but a user may set MODEL_OVERRIDE to a
   // prefixed form. Be forgiving on the lookup side.
   codex: ["openai/", "github-copilot/"],
@@ -69,6 +70,10 @@ const ROUTING_PREFIXES_BY_PROVIDER: Record<PricingProvider, readonly string[]> =
   // The Grok CLI reports a bare xAI id (`grok-4.6`) or `openrouter/<vendor>/<id>`
   // for an OpenRouter model; stripping the prefix lands it on the openrouter rows.
   grok: ["openrouter/", "xai/"],
+  // fx reports the swarm model string: `openrouter/<vendor>/<id>` (OpenRouter
+  // connection), `vercel/<vendor>/<id>` (AI Gateway) or a bare OpenAI id.
+  // Stripping the route prefix lands the first two on `<vendor>/<id>` rows.
+  fx: ["openrouter/", "vercel/"],
 };
 
 /** `gpt-5-nano-2025-08-07` -> `gpt-5-nano`. Anthropic's 8-digit dates (`-20251001`) are real catalog ids and are left alone. */

package/src/be/scripts/typecheck.ts

@@ -315,6 +315,7 @@ export interface SwarmSdk {
   slack_downloadFile(args: { url: string }): Promise<unknown>;
   slack_delete(args: { channelId: string; messageTs: string }): Promise<unknown>;
   slack_update(args: { channelId: string; messageTs: string; message: string }): Promise<unknown>;
+  slack_leaveThread(args: { taskId?: string; channelId?: string; threadTs?: string }): Promise<unknown>;
 
   // --- write: chat sdk ---
   chat_reply(args: { text: string }): Promise<unknown>;

package/src/be/seed/schedules-seeder.ts

@@ -76,8 +76,11 @@ import {
   computeContentHash,
   createScheduledTask,
   getScheduledTaskByName,
+  getWorkflow,
+  listWorkflows,
   updateScheduledTask,
 } from "../db";
+import { getScript } from "../scripts/db";
 import { resolveSeededEnabled } from "./automation-toggle";
 import type { Seeder, SeedItem } from "./types";
 import { canonicalJson } from "./workflows-seeder";
@@ -98,8 +101,27 @@ type ScheduleBlock = {
   cron: string;
   timezone?: string;
   enabled?: boolean;
+  /** What a fire runs. Default `agent-task`: the `## Scheduled Task` prompt becomes a task. */
+  targetType?: ScheduleTargetType;
+  /** `targetType: "workflow"`: the workflow's name, resolved to its id at apply time. */
+  workflow?: string;
+  /** `targetType: "script"`: a global script, run directly with `scriptArgs`. */
+  scriptName?: string;
+  scriptArgs?: Record<string, unknown>;
 };
 
+type ScheduleTargetType = "agent-task" | "workflow" | "script";
+const TARGET_TYPES: readonly ScheduleTargetType[] = ["agent-task", "workflow", "script"];
+
+/**
+ * The non-default target of a seeded schedule. Agent-task schedules carry none
+ * of these keys, so their seed hash is unchanged from before targets existed
+ * and recorded seed state on existing installs still matches.
+ */
+type SeedScheduleTarget =
+  | { targetType: "workflow"; workflow: string }
+  | { targetType: "script"; scriptName: string; scriptArgs: Record<string, unknown> };
+
 export type SeedSchedule = {
   name: string;
   description: string;
@@ -112,7 +134,7 @@ export type SeedSchedule = {
   params: Record<string, unknown>;
   requiredParams: string[];
   requires: AutomationIntegrationId[];
-};
+} & (SeedScheduleTarget | { targetType?: undefined });
 
 export type ScheduleTemplateSource = { config: string; content: string };
 type ScheduleSeedItem = SeedItem & { schedule: SeedSchedule };
@@ -167,10 +189,21 @@ function parseScheduleSource(source: ScheduleTemplateSource): SeedSchedule | nul
   const block = JSON.parse(blockMatch[1]) as ScheduleBlock;
   const afterBlock = scheduleStart + blockMatch.index! + blockMatch[0].length;
   const taskHeading = source.content.indexOf("## Scheduled Task", afterBlock);
-  const taskTemplate = source.content
-    .slice(taskHeading >= 0 ? taskHeading + "## Scheduled Task".length : afterBlock)
-    .trim();
-  if (!taskTemplate) throw new Error(`Schedule template ${config.name} has no task prompt`);
+  const target = parseScheduleTarget(config.name, block);
+  let taskTemplate = "";
+  if (target) {
+    // A workflow or script fire never reads a prompt: shipping one is a mistake.
+    if (taskHeading >= 0) {
+      throw new Error(
+        `Schedule template ${config.name} targets a ${target.targetType} but ships a ## Scheduled Task prompt it would ignore`,
+      );
+    }
+  } else {
+    taskTemplate = source.content
+      .slice(taskHeading >= 0 ? taskHeading + "## Scheduled Task".length : afterBlock)
+      .trim();
+    if (!taskTemplate) throw new Error(`Schedule template ${config.name} has no task prompt`);
+  }
 
   const requires = config.requires ?? [];
   const requiredParams = config.placeholders ?? [];
@@ -196,7 +229,37 @@ function parseScheduleSource(source: ScheduleTemplateSource): SeedSchedule | nul
     params: {},
     requiredParams,
     requires,
+    ...target,
+  };
+}
+
+/** Validate the block's target fields. Returns null for the default agent-task target. */
+function parseScheduleTarget(name: string, block: ScheduleBlock): SeedScheduleTarget | null {
+  const targetType = block.targetType ?? "agent-task";
+  if (!TARGET_TYPES.includes(targetType)) {
+    throw new Error(`Schedule template ${name} has unknown targetType "${targetType}"`);
+  }
+  const stray = (fields: (keyof ScheduleBlock)[]) => {
+    const set = fields.filter((field) => block[field] !== undefined);
+    if (set.length > 0) {
+      throw new Error(
+        `Schedule template ${name} (targetType ${targetType}) sets ${set.join(", ")}, which it would ignore`,
+      );
+    }
   };
+  switch (targetType) {
+    case "agent-task":
+      stray(["workflow", "scriptName", "scriptArgs"]);
+      return null;
+    case "workflow":
+      stray(["scriptName", "scriptArgs"]);
+      if (!block.workflow) throw new Error(`Schedule template ${name} has no workflow name`);
+      return { targetType, workflow: block.workflow };
+    case "script":
+      stray(["workflow"]);
+      if (!block.scriptName) throw new Error(`Schedule template ${name} has no scriptName`);
+      return { targetType, scriptName: block.scriptName, scriptArgs: block.scriptArgs ?? {} };
+  }
 }
 
 export function loadSeedSchedules(
@@ -212,7 +275,27 @@ function scheduleSeedHash(schedule: SeedSchedule): string {
   return computeContentHash(canonicalJson(schedule));
 }
 
-function scheduleFromRow(schedule: ScheduledTask): SeedSchedule {
+async function scheduleTargetFromRow(
+  schedule: ScheduledTask,
+): Promise<SeedScheduleTarget | undefined> {
+  switch (schedule.targetType) {
+    case "workflow": {
+      const workflow = schedule.workflowId ? await getWorkflow(schedule.workflowId) : null;
+      // A dangling id can never equal a seeded name, so the row reads as edited.
+      return { targetType: "workflow", workflow: workflow?.name ?? `id:${schedule.workflowId}` };
+    }
+    case "script":
+      return {
+        targetType: "script",
+        scriptName: schedule.scriptName ?? "",
+        scriptArgs: schedule.scriptArgs ?? {},
+      };
+    default:
+      return undefined;
+  }
+}
+
+async function scheduleFromRow(schedule: ScheduledTask): Promise<SeedSchedule> {
   return {
     name: schedule.name,
     description: schedule.description ?? "",
@@ -225,9 +308,48 @@ function scheduleFromRow(schedule: ScheduledTask): SeedSchedule {
     params: schedule.params ?? {},
     requiredParams: schedule.requiredParams ?? [],
     requires: schedule.requires ?? [],
+    ...(await scheduleTargetFromRow(schedule)),
   };
 }
 
+/** Resolve a seeded target to row fields, failing the item when its target is missing. */
+async function resolveTargetFields(schedule: SeedSchedule) {
+  switch (schedule.targetType) {
+    case "workflow": {
+      const name = schedule.workflow;
+      const workflow = (await listWorkflows()).find((candidate) => candidate.name === name);
+      if (!workflow) throw new Error(`Workflow "${name}" not found`);
+      return {
+        targetType: "workflow" as const,
+        workflowId: workflow.id,
+        scriptName: null,
+        scriptArgs: null,
+        taskTemplate: null,
+      };
+    }
+    case "script": {
+      if (!(await getScript({ name: schedule.scriptName, scope: "global" }))) {
+        throw new Error(`Global script "${schedule.scriptName}" not found`);
+      }
+      return {
+        targetType: "script" as const,
+        workflowId: null,
+        scriptName: schedule.scriptName,
+        scriptArgs: schedule.scriptArgs,
+        taskTemplate: null,
+      };
+    }
+    default:
+      return {
+        targetType: "agent-task" as const,
+        workflowId: null,
+        scriptName: null,
+        scriptArgs: null,
+        taskTemplate: schedule.taskTemplate,
+      };
+  }
+}
+
 function nextRunAt(schedule: SeedSchedule): string | null {
   try {
     // Disabled templates can await a required timezone parameter. Validate the
@@ -263,7 +385,7 @@ export function createSchedulesSeeder(
 
     async upstreamHash(item): Promise<string | null> {
       const existing = await getScheduledTaskByName(item.key);
-      return existing ? scheduleSeedHash(scheduleFromRow(existing)) : null;
+      return existing ? scheduleSeedHash(await scheduleFromRow(existing)) : null;
     },
 
     async apply(item): Promise<void> {
@@ -274,8 +396,7 @@ export function createSchedulesSeeder(
         cronExpression: schedule.cronExpression,
         timezone: schedule.timezone,
         enabled: schedule.enabled,
-        targetType: "agent-task" as const,
-        taskTemplate: schedule.taskTemplate,
+        ...(await resolveTargetFields(schedule)),
         taskType: schedule.taskType,
         tags: schedule.tags,
         params: schedule.params,
@@ -284,11 +405,16 @@ export function createSchedulesSeeder(
       };
       const existing = await getScheduledTaskByName(schedule.name);
       if (existing) {
+        // Nulls clear the previous target's fields when a template changes target.
         await updateScheduledTask(existing.id, { ...data, nextRunAt: resolvedNextRunAt });
       } else {
         await createScheduledTask({
           name: schedule.name,
           ...data,
+          workflowId: data.workflowId ?? undefined,
+          scriptName: data.scriptName ?? undefined,
+          scriptArgs: data.scriptArgs ?? undefined,
+          taskTemplate: data.taskTemplate ?? undefined,
           nextRunAt: resolvedNextRunAt ?? undefined,
         });
       }

package/src/be/seed/workflows-seeder.ts

@@ -71,10 +71,18 @@ import type {
   TriggerConfig,
   Workflow,
   WorkflowDefinition,
+  WorkflowSnapshot,
 } from "../../types";
 import { validateDefinition } from "../../workflows/definition";
-import { computeContentHash, createWorkflow, listWorkflows, updateWorkflow } from "../db";
+import {
+  computeContentHash,
+  createWorkflow,
+  getWorkflowVersions,
+  listWorkflows,
+  updateWorkflow,
+} from "../db";
 import { resolveSeededEnabled } from "./automation-toggle";
+import { getSeedState } from "./state-db";
 import type { Seeder, SeedItem } from "./types";
 
 type AutomationTemplateConfig = {
@@ -220,6 +228,62 @@ function workflowFromRow(workflow: Workflow): SeedWorkflow {
   };
 }
 
+function workflowFromSnapshot(snapshot: WorkflowSnapshot): SeedWorkflow {
+  return {
+    name: snapshot.name,
+    description: snapshot.description ?? "",
+    enabled: snapshot.enabled,
+    definition: snapshot.definition,
+    triggers: snapshot.triggers,
+    cooldown: snapshot.cooldown,
+    input: snapshot.input,
+    triggerSchema: snapshot.triggerSchema,
+    params: snapshot.params ?? {},
+    requiredParams: snapshot.requiredParams ?? [],
+    requires: snapshot.requires ?? [],
+  };
+}
+
+/**
+ * What a run executes, without the settings an operator is told to change:
+ * inputs (plain data, resolved the same for every caller), on/off, cooldown,
+ * description and event triggers.
+ */
+function executableSurface(workflow: SeedWorkflow): string {
+  const {
+    input: _input,
+    enabled: _enabled,
+    cooldown: _cooldown,
+    description: _description,
+    triggers: _triggers,
+    ...surface
+  } = workflow;
+  return canonicalJson(surface);
+}
+
+/**
+ * Whether a live workflow still runs seed source: `pristine` while what it
+ * executes matches what the seeder last wrote for its name, `edited` once
+ * anyone changed that, `unseeded` for a workflow the seeder never wrote.
+ * Operator settings (see `executableSurface`) keep it `pristine`. The seeded
+ * state is the live row itself or, once edited, the version snapshot taken
+ * before the first edit; an edit with no such snapshot counts as `edited`.
+ */
+export async function seededWorkflowState(
+  workflow: Workflow,
+): Promise<"pristine" | "edited" | "unseeded"> {
+  const state = await getSeedState("workflow", workflow.name);
+  if (!state) return "unseeded";
+  const live = workflowFromRow(workflow);
+  if (workflowSeedHash(live) === state.seededHash) return "pristine";
+  for (const version of await getWorkflowVersions(workflow.id)) {
+    const seeded = workflowFromSnapshot(version.snapshot);
+    if (workflowSeedHash(seeded) !== state.seededHash) continue;
+    return executableSurface(seeded) === executableSurface(live) ? "pristine" : "edited";
+  }
+  return "edited";
+}
+
 export function createWorkflowsSeeder(
   sources: readonly WorkflowTemplateSource[] = BUILT_IN_WORKFLOW_SOURCES,
 ): Seeder<WorkflowSeedItem> {

package/src/be/seed-pricing.ts

@@ -299,6 +299,8 @@ export function buildModelsDevSeedRows(cache: ModelsDevCache): PricingSeedRow[]
     // strips the prefix, so we seed the bare id under `pi` too. Without this
     // every gh-copilot-backed pi run fell through to `costSource='unpriced'`.
     add(id, projectCostBlock("pi", id, model.cost));
+    // fx runs a bare OpenAI id on its `openai` custom connection.
+    add(id, projectCostBlock("fx", id, model.cost));
   }
 
   // ---- Cursor (bare vendor ids through Cursor's hosted inference) --------
@@ -358,6 +360,13 @@ export function buildModelsDevSeedRows(cache: ModelsDevCache): PricingSeedRow[]
         anthropicBilled: id.startsWith("anthropic/"),
       }),
     );
+    // fx runs `openrouter/<id>` on its OpenRouter custom connection.
+    add(
+      id,
+      projectCostBlock("fx", id, model.cost, {
+        anthropicBilled: id.startsWith("anthropic/"),
+      }),
+    );
     // Gemini specifically: also project under the 'gemini' provider so
     // internal-ai callers that tag with provider='gemini' find a hit.
     if (id.startsWith("google/")) {
@@ -369,6 +378,20 @@ export function buildModelsDevSeedRows(cache: ModelsDevCache): PricingSeedRow[]
     }
   }
 
+  // ---- fx on Vercel AI Gateway (`vercel/<vendor>/<id>`) -------------------
+  // The prefix is stripped at lookup, so a gateway id lands on the same key as
+  // its OpenRouter twin. OpenRouter's row wins where both list the model (one
+  // source per key); the gateway section fills the ids OpenRouter lacks.
+  for (const [id, model] of Object.entries(cache.vercel?.models ?? {})) {
+    if (!model?.cost || openrouter[id]?.cost) continue;
+    add(
+      id,
+      projectCostBlock("fx", id, model.cost, {
+        anthropicBilled: id.startsWith("anthropic/"),
+      }),
+    );
+  }
+
   // ---- OpenAI-compatible registry providers ($0 flat-rate subscriptions) --
   // pi and opencode run these as `<provider>/<id>`. The models.dev `nan`
   // section and the registry-synthesized `helmcode` section

package/src/be/steering.ts

@@ -1,3 +1,5 @@
+import { z } from "zod";
+import type { TaskSteerEvent } from "../extensions/contract";
 import {
   type Agent,
   type AgentTask,
@@ -37,6 +39,20 @@ export class SteeringRequestError extends Error {
   }
 }
 
+export class SteeringBlockedError extends SteeringRequestError {
+  constructor(
+    public readonly reason: string,
+    public readonly extension: { id: string; name: string },
+  ) {
+    super(`Steering blocked by extension ${extension.name}: ${reason}`, 403);
+    this.name = "SteeringBlockedError";
+  }
+}
+
+const steeringModifySchema = z.strictObject({
+  message: z.string().refine((message) => message.trim().length > 0, "Message must not be empty"),
+});
+
 /** Server-side entry point for the global steering kill switch. */
 export function isSteeringEnabled(): boolean {
   return readSteeringEnabled();
@@ -51,6 +67,8 @@ export interface RequestSteeringArgs {
   createdByKind?: SteeringMessage["createdByKind"];
   createdByUserId?: string;
   createdByAgentId?: string;
+  messageTimestamps?: string[];
+  slack?: TaskSteerEvent["slack"];
 }
 
 async function providerForTask(task: AgentTask): Promise<ProviderName> {
@@ -291,7 +309,36 @@ export async function requestSteering(args: RequestSteeringArgs): Promise<SteerR
 
   const requestedMode = args.mode ?? "queue";
   const onUnsupported = args.onUnsupported ?? "degrade";
-  const provider = await providerForTask(task);
+  // The dispatcher loads task/workflow assets; keep it off the HTTP boot import cycle.
+  const { dispatchPre, extensionIdForAgent } = await import("../extensions/dispatcher");
+  const preSteer = await dispatchPre(
+    "pre.task.steer",
+    {
+      task,
+      message: args.message,
+      mode: requestedMode,
+      source: args.source ?? "api",
+      sender: {
+        kind: args.createdByKind ?? "system",
+        userId: args.createdByUserId,
+        agentId: args.createdByAgentId,
+      },
+      messageTimestamps: args.messageTimestamps,
+      slack: args.slack,
+    },
+    {
+      skipExtensionId: extensionIdForAgent(args.createdByAgentId),
+      validateModify: (data) => steeringModifySchema.safeParse(data),
+    },
+  );
+  if (preSteer.action === "block") {
+    throw new SteeringBlockedError(preSteer.reason, preSteer.extension);
+  }
+
+  // A hook can outlive the running session. Decide delivery from the current task.
+  const currentTask = await getTaskById(args.taskId);
+  if (!currentTask) throw new SteeringRequestError("Task not found", 404);
+  const provider = await providerForTask(currentTask);
   const supportedModes = PROVIDER_STEER_CAPABILITIES[provider];
 
   if (onUnsupported === "fail" && !supportedModes.includes(requestedMode)) {
@@ -302,12 +349,12 @@ export async function requestSteering(args: RequestSteeringArgs): Promise<SteerR
     );
   }
 
-  const activeTask = task.status === "paused" ? await resumeTask(task.id) : task;
+  const activeTask = currentTask.status === "paused" ? await resumeTask(task.id) : currentTask;
   if (!activeTask) {
     throw new SteeringRequestError("Failed to resume paused task", 500);
   }
 
-  const body = scrubSecrets(args.message);
+  const body = scrubSecrets(preSteer.action === "modify" ? preSteer.data.message : args.message);
   // A task whose session hasn't started yet can still accept queued steering:
   // the row stays `pending` and the worker delivers it once the session is
   // live (the dispatch poll covers every active task). Interrupting a session

package/src/be/swarm-config-guard.ts

@@ -508,6 +508,7 @@ const VALIDATED_KEYS: Record<string, ConfigValidator> = {
     "ADDITIVE_SLACK",
     "SLACK_THREAD_FOLLOWUP_REQUIRE_MENTION",
     "SLACK_THREAD_WAKE_ON_ANY_MESSAGE",
+    "SLACK_LEAVE_THREAD_DISABLE",
     "RBAC_ENABLED",
     "SEED_AUTOMATIONS_ENABLED",
     "RBAC_AUDIT_DISABLED",

package/src/commands/provider-credentials.ts

@@ -20,6 +20,7 @@
 
 import {
   openAICompatibleKeyVars,
+  openAICompatibleProvider,
   openAICompatibleProviders,
   providerBaseUrl,
   providerKeyFromEnv,
@@ -34,6 +35,7 @@ import { hasCodexOAuthPoolSlots } from "../providers/codex-oauth/env-keys";
 import { checkCursorCredentials } from "../providers/cursor-adapter";
 import { checkDevinCredentials } from "../providers/devin-adapter";
 import { checkDshCredentials } from "../providers/dsh-adapter";
+import { checkFxCredentials } from "../providers/fx-adapter";
 import { checkGrokCredentials } from "../providers/grok-adapter";
 import { checkOpencodeCredentials } from "../providers/opencode-adapter";
 import type { CredCheckOptions, CredStatus } from "../providers/types";
@@ -85,7 +87,8 @@ export type SupportedProvider =
   | "dsh"
   | "cursor"
   | "amp"
-  | "grok";
+  | "grok"
+  | "fx";
 
 /**
  * True when the pi harness authenticates against Bedrock rather than a provider
@@ -158,6 +161,7 @@ export const REQUIRED_CRED_VARS_BY_PROVIDER: Record<SupportedProvider, readonly
   amp: ["AMP_API_KEY"],
   cursor: ["CURSOR_API_KEY"],
   grok: ["XAI_API_KEY", "OPENROUTER_API_KEY"],
+  fx: ["OPENROUTER_API_KEY", "OPENAI_API_KEY", "AI_GATEWAY_API_KEY"],
 };
 
 type CredentialChecker = (
@@ -171,6 +175,7 @@ export const CREDENTIAL_PROVIDER_CHECKERS: Record<SupportedProvider, CredentialC
   amp: (env) => checkAmpCredentials(env),
   cursor: (env) => checkCursorCredentials(env),
   grok: (env) => checkGrokCredentials(env),
+  fx: (env) => checkFxCredentials(env),
   claude: (env) => checkClaudeCredentials(env),
   "claude-managed": (env) => checkClaudeManagedCredentials(env),
   codex: (env, opts) => checkCodexCredentials(env, opts),
@@ -383,6 +388,7 @@ function parseCodexOAuthAccess(blob: string | undefined): string | null {
  * | `devin`          | `DEVIN_API_KEY` (+ `DEVIN_API_BASE_URL` override)                       | `${baseUrl}/v3/self`            |
  * | `dsh`            | `DEEPSEEK_API_KEY` → `OPENROUTER_API_KEY`                               | DeepSeek `/models`, or OpenRouter `/key` |
  * | `amp`            | `AMP_API_KEY`                                                           | `amp usage` (credit balance, no inference; 5s timeout) |
+ * | `fx`             | `OPENROUTER_API_KEY` → `OPENAI_API_KEY` → `AI_GATEWAY_API_KEY`          | OpenRouter `/key`, OpenAI `/v1/models`, or AI Gateway `/v1/models` |
  *
  * Returns `{ok: true, latency_ms}` on 2xx, `{ok: false, error, latency_ms}`
  * otherwise. Errors are scrubbed via `scrubSecrets` before being returned.
@@ -639,12 +645,33 @@ export async function validateProviderCredentials(
           latency_ms: Date.now() - startedAt,
         };
       }
+      case "fx": {
+        // Same keys as `checkFxCredentials`, probed in route-table order.
+        const openRouterKey = env.OPENROUTER_API_KEY?.trim();
+        if (openRouterKey) {
+          return checkEachKey("OPENROUTER_API_KEY", openRouterKey, checkOpenRouter);
+        }
+        const openAiKey = env.OPENAI_API_KEY?.trim();
+        if (openAiKey) return checkEachKey("OPENAI_API_KEY", openAiKey, checkOpenAiApiKey);
+        const gatewayKey = env.AI_GATEWAY_API_KEY?.trim();
+        const gateway = openAICompatibleProvider("vercel");
+        if (gatewayKey && gateway) {
+          return checkEachKey("AI_GATEWAY_API_KEY", gatewayKey, (member) =>
+            checkOpenAICompatibleProvider(gateway, member),
+          );
+        }
+        return {
+          ok: false,
+          error: "Set OPENROUTER_API_KEY, OPENAI_API_KEY or AI_GATEWAY_API_KEY for fx.",
+          latency_ms: Date.now() - startedAt,
+        };
+      }
       case "acp":
         return presenceCheckOk();
       default:
         return {
           ok: false,
-          error: `Unknown provider "${provider}". Supported: claude, claude-managed, codex, devin, opencode, pi, acp, dsh, cursor, amp, grok.`,
+          error: `Unknown provider "${provider}". Supported: claude, claude-managed, codex, devin, opencode, pi, acp, dsh, cursor, amp, grok, fx.`,
           latency_ms: Date.now() - startedAt,
         };
     }