Opt-in OpenRouter hardening + subagent kill switch (redo of #50 against current main)

[blue-az]

Summary

This supersedes #50. That PR hardened the OpenRouter path against main as of early July; main has since landed ChatGPT/Codex OAuth login, the connector system, output modes, and a rewritten docs-only-backend, all of which touched every function #50 modified (createModel, the createDeepAgent call site, createModeInstructions). Rather than force a conflict resolution across that much drift, this re-implements the same three opt-in controls directly against current main.

All three are strictly opt-in — with nothing set, behavior is unchanged for every provider:

• OPENWIKI_OPENROUTER_MAX_INPUT_TOKENS — attaches a maxInputTokens profile to OpenRouter model instances (Object.defineProperty, so a frozen/non-extensible instance doesn't crash), so DeepAgents' summarization middleware triggers early enough to stay under OpenRouter's payload limit on constrained/budget models, instead of failing with an HTTP 500 on large transcripts. Suggested value for constrained models: 15000.
• OPENWIKI_DISABLE_MODEL_FALLBACK=1 — disables OpenRouter's route: "fallback" model list for deterministic single-model runs.
• OPENWIKI_DISABLE_SUBAGENTS=1 — excludes the task tool from the model, enforced in two places that share one tool-name constant: a registered DeepAgents harness profile (excludedTools, generalPurposeSubagent.enabled: false) and runtime middleware (wrapModelCall filters task out of the tool list). The subagent-discipline prompt text is swapped to match, so the system prompt doesn't tell the model it can delegate when the tool has been removed.

Also: openwiki.* variant directories (testing/validation copies of generated docs) are excluded from repository discovery in the prompt, so they're never inspected or documented as part of a real run.

Why bundle these three

They're independent switches but came from the same investigation (hardening a constrained-model OpenRouter run) and the original review thread on #50 already covered this scope; splitting them into separate PRs now would just re-litigate settled ground. Happy to split on request.

Test plan

• pnpm run typecheck — clean
• pnpm run lint:check — clean
• pnpm run format:check — clean
• pnpm run build — clean
• pnpm test — 213/213 passing across 20 files, including two new files:
  • test/subagent-disable.test.ts — isSubagentDisabled only trips on the literal "1"; buildSubagentDisabledProfile()'s shape; default behavior unchanged (no middleware, no tools removed) when unset; the task tool is filtered from the model call when disabled, all other tools pass through unchanged.
  • test/openrouter-hardening.test.ts — isModelFallbackDisabled only trips on "1"; non-OpenRouter providers never get a fallback list; OpenRouter gets the primary model plus fallback ids by default, without duplicating the primary when it's also a fallback id; disabled collapses to a single model; resolveOpenRouterMaxInputTokens parsing (unset → undefined, non-numeric → undefined, valid → parsed).
  • Extended test/prompt.test.ts for the openwiki.* exclusion bullet and both branches of the subagent-discipline text.

🤖 Generated with Claude Code

[blue-az]

PRATHAM KUMAR (@rajpratham1) tagging you since you reviewed the original version of this on #50 — this is the same hardening (OpenRouter token-cap, model-fallback disable, subagent kill switch), redone against current main since #50's base had drifted too far to cleanly rebase. Test coverage for the subagent-disable path (your original ask) carried over, plus new coverage for the fallback-route and token-cap logic.