@agent-native/core 0.101.3 → 0.101.5

package/corpus/core/src/client/use-run-stuck-detection.ts

@@ -63,10 +63,10 @@ export interface UseRunStuckDetectionOptions {
    */
   backgroundStuckThresholdMs?: number;
   /**
-   * Threshold for a claimed durable background worker that is still sending
-   * fresh process heartbeats. These workers can legitimately spend up to the
-   * 12-minute tool/no-progress window on large Design, Plan, or Assets work.
-   * Default 13 minutes, matching the durable chunk handoff boundary.
+   * Legacy upper bound for a claimed durable background worker that is still
+   * sending fresh process heartbeats. Informational quiet-run UI is never
+   * delayed past `backgroundStuckThresholdMs`; this option can only request an
+   * earlier notice for live workers. Default 13 minutes.
    */
   liveBackgroundStuckThresholdMs?: number;
   /** Poll interval. Default 5_000ms. */
@@ -127,6 +127,137 @@ export function useRunStuckDetection({
     const base = apiUrl ?? agentNativePath("/_agent-native/agent-chat");
     let cancelled = false;
     let timer: ReturnType<typeof setTimeout> | null = null;
+    let snapshotTransitionTimer: ReturnType<typeof setTimeout> | null = null;
+    let snapshotVersion = 0;
+
+    type RunHealthSnapshot = {
+      active: boolean;
+      runId: string | null;
+      status: string | null;
+      lastProgressAt: number | null;
+      stuckSinceMs: number | null;
+      heartbeatAt: number | null;
+      heartbeatSinceMs: number | null;
+      dispatchMode: string | null;
+    };
+
+    const effectiveThresholdFor = (
+      dispatchMode: string | null,
+      heartbeatSinceMs: number | null,
+    ) => {
+      const liveBackgroundWorker =
+        dispatchMode === "background-processing" &&
+        heartbeatSinceMs != null &&
+        heartbeatSinceMs >= 0 &&
+        heartbeatSinceMs < FRESH_BACKGROUND_HEARTBEAT_MS;
+      const serverContinued =
+        dispatchMode === "foreground-self-chain" ||
+        dispatchMode?.startsWith("background") === true;
+      return liveBackgroundWorker
+        ? Math.min(backgroundStuckThresholdMs, liveBackgroundStuckThresholdMs)
+        : serverContinued
+          ? backgroundStuckThresholdMs
+          : stuckThresholdMs;
+    };
+
+    const scheduleSnapshotTransition = (
+      snapshot: RunHealthSnapshot,
+      observedAtMs: number,
+      version: number,
+    ) => {
+      if (snapshotTransitionTimer) clearTimeout(snapshotTransitionTimer);
+      snapshotTransitionTimer = null;
+      if (
+        cancelled ||
+        version !== snapshotVersion ||
+        !snapshot.active ||
+        snapshot.status !== "running" ||
+        snapshot.runId == null
+      ) {
+        return;
+      }
+
+      const currentElapsedMs = Math.max(0, Date.now() - observedAtMs);
+      const currentHeartbeatSinceMs =
+        snapshot.heartbeatSinceMs == null
+          ? null
+          : snapshot.heartbeatSinceMs + currentElapsedMs;
+      const currentStuckSinceMs =
+        snapshot.stuckSinceMs == null
+          ? null
+          : snapshot.stuckSinceMs + currentElapsedMs;
+      const effectiveThresholdMs = effectiveThresholdFor(
+        snapshot.dispatchMode,
+        currentHeartbeatSinceMs,
+      );
+      const currentlyStuck = Boolean(
+        currentStuckSinceMs != null &&
+        currentStuckSinceMs > effectiveThresholdMs,
+      );
+      const transitionDelaysMs: number[] = [];
+      if (
+        currentHeartbeatSinceMs != null &&
+        currentHeartbeatSinceMs >= 0 &&
+        currentHeartbeatSinceMs < FRESH_BACKGROUND_HEARTBEAT_MS
+      ) {
+        transitionDelaysMs.push(
+          FRESH_BACKGROUND_HEARTBEAT_MS - currentHeartbeatSinceMs + 1,
+        );
+      }
+      if (currentStuckSinceMs != null && !currentlyStuck) {
+        transitionDelaysMs.push(
+          Math.max(1, effectiveThresholdMs - currentStuckSinceMs + 1),
+        );
+      }
+      if (transitionDelaysMs.length === 0) return;
+
+      // Both ages originate from the server clock. Advance those snapshots by
+      // only a local elapsed duration, which remains safe when client/server
+      // wall clocks differ. Wake at the earlier semantic boundary, then
+      // reschedule if the other boundary is still ahead.
+      const delayMs = Math.max(1, Math.min(...transitionDelaysMs));
+      snapshotTransitionTimer = setTimeout(() => {
+        snapshotTransitionTimer = null;
+        if (cancelled || version !== snapshotVersion) return;
+        const elapsedSinceObservationMs = Math.max(
+          0,
+          Date.now() - observedAtMs,
+        );
+        const nextHeartbeatSinceMs =
+          snapshot.heartbeatSinceMs == null
+            ? null
+            : snapshot.heartbeatSinceMs + elapsedSinceObservationMs;
+        const nextStuckSinceMs =
+          snapshot.stuckSinceMs == null
+            ? null
+            : snapshot.stuckSinceMs + elapsedSinceObservationMs;
+        const nextEffectiveThresholdMs = effectiveThresholdFor(
+          snapshot.dispatchMode,
+          nextHeartbeatSinceMs,
+        );
+        const nextIsStuck = Boolean(
+          nextStuckSinceMs != null &&
+          nextStuckSinceMs > nextEffectiveThresholdMs,
+        );
+        setState((current) => {
+          if (
+            version !== snapshotVersion ||
+            current.runId !== snapshot.runId ||
+            current.lastProgressAt !== snapshot.lastProgressAt ||
+            current.heartbeatAt !== snapshot.heartbeatAt
+          ) {
+            return current;
+          }
+          return {
+            ...current,
+            isStuck: nextIsStuck,
+            stuckSinceMs: nextStuckSinceMs,
+            heartbeatSinceMs: nextHeartbeatSinceMs,
+          };
+        });
+        scheduleSnapshotTransition(snapshot, observedAtMs, version);
+      }, delayMs);
+    };
 
     const poll = async () => {
       if (cancelled) return;
@@ -153,34 +284,38 @@ export function useRunStuckDetection({
             heartbeatAt != null ? nowMs - heartbeatAt : null;
           const dispatchMode =
             typeof data.dispatchMode === "string" ? data.dispatchMode : null;
-          // Server-continued runs get the wider threshold: the server's own
-          // recovery (150s no-progress backstop + chained continuations) must
-          // get its chance before the user sees a "stuck" affordance.
-          const serverContinued =
-            dispatchMode === "foreground-self-chain" ||
-            dispatchMode?.startsWith("background") === true;
           // A claimed durable worker with a fresh heartbeat can legitimately
-          // be waiting on a bounded long-running tool/sub-agent call. Showing
-          // Retry at the generic 3-minute continuation threshold aborts healthy
-          // work and starts the same call again. Let the worker's own 12-minute
-          // watchdog act first; a dead/stale heartbeat still gets the earlier
-          // background fallback below.
-          const liveBackgroundWorker =
-            dispatchMode === "background-processing" &&
-            heartbeatSinceMs != null &&
-            heartbeatSinceMs >= 0 &&
-            heartbeatSinceMs < FRESH_BACKGROUND_HEARTBEAT_MS;
-          const effectiveThresholdMs = liveBackgroundWorker
-            ? liveBackgroundStuckThresholdMs
-            : serverContinued
-              ? backgroundStuckThresholdMs
-              : stuckThresholdMs;
+          // be waiting on a bounded long-running tool/sub-agent call. Still
+          // surface informational status at the normal background threshold;
+          // RunStuckBanner uses the fresh heartbeat to withhold Retry while
+          // keeping an explicit Cancel available. The legacy live-worker
+          // threshold may make that notice earlier, but never later.
+          const effectiveThresholdMs = effectiveThresholdFor(
+            dispatchMode,
+            heartbeatSinceMs,
+          );
           const isStuck = Boolean(
             data.active &&
             data.status === "running" &&
             stuckSinceMs != null &&
             stuckSinceMs > effectiveThresholdMs,
           );
+          const observedAtMs = Date.now();
+          const version = ++snapshotVersion;
+          scheduleSnapshotTransition(
+            {
+              active: data.active,
+              runId: data.runId ?? null,
+              status: data.status ?? null,
+              lastProgressAt,
+              stuckSinceMs,
+              heartbeatAt,
+              heartbeatSinceMs,
+              dispatchMode,
+            },
+            observedAtMs,
+            version,
+          );
           setState({
             isStuck,
             runId: data.runId ?? null,
@@ -217,7 +352,9 @@ export function useRunStuckDetection({
 
     return () => {
       cancelled = true;
+      snapshotVersion += 1;
       if (timer) clearTimeout(timer);
+      if (snapshotTransitionTimer) clearTimeout(snapshotTransitionTimer);
     };
   }, [
     threadId,

package/corpus/core/src/coding-tools/run-code.ts

@@ -139,7 +139,7 @@ export function createRunCodeEntry(
         "  - `workspaceList(prefix?)` — list workspace files, returns [{ path, sizeBytes, contentType, updatedAt }].",
         "Print results with `console.log()`; only stdout+stderr are returned.",
         "Timeout defaults to 120 s (max 600 s). Output is truncated to 50 000 chars by default (max 200 000).",
-        'For LONG compute — big cross-source joins, corpus-wide sweeps, scripts that could exceed ~30 s, or anything at risk of dying with the current chat run — pass `background: true`. That enqueues a durable execution and returns `{ executionId, status: "queued" }` immediately; the code runs out-of-band with a generous budget (default 10 min) and its result survives run timeouts. Continue other work, then poll by calling run-code again with just `{ executionId }` to get status and, once finished, the output. Keep quick scripts in the default foreground mode.',
+        'For LONG compute — big cross-source joins, corpus-wide sweeps, scripts that could exceed ~30 s, or anything at risk of dying with the current chat run — pass `background: true`. That enqueues a durable execution and returns `{ executionId, status: "queued" }` immediately; the code runs out-of-band with a generous budget (default 10 min) and its result survives run timeouts. Continue other work, then poll with `get-code-execution` when that dedicated tool is available; legacy hosts can call run-code again with just `{ executionId }`. Keep quick scripts in the default foreground mode.',
       ].join(" "),
       parameters: {
         type: "object",
@@ -160,12 +160,12 @@ export function createRunCodeEntry(
           background: {
             type: "boolean",
             description:
-              'Run as a durable background execution: returns { executionId, status: "queued" } immediately and the code executes out-of-band, surviving chat-run timeouts. Use for long compute (large joins, multi-page provider sweeps, heavy analysis). Poll with executionId for the result.',
+              'Run as a durable background execution: returns { executionId, status: "queued" } immediately and the code executes out-of-band, surviving chat-run timeouts. Use for long compute (large joins, multi-page provider sweeps, heavy analysis). Poll with get-code-execution when available.',
           },
           executionId: {
             type: "string",
             description:
-              "Poll a background execution started earlier: pass the executionId alone (no code) to get its status and, once finished, its output.",
+              "Legacy polling fallback for hosts without get-code-execution: pass the executionId alone (no code) to get status and output.",
           },
         },
         required: [],
@@ -582,12 +582,18 @@ function formatTerminalSandboxExecution(row: SandboxExecutionRow): string {
 /**
  * Standalone, access-scoped poll tool for background executions. Behaviorally
  * identical to calling `run-code` with only `executionId`; hosts that register
- * it as `get-code-execution` give the model a dedicated read tool (and the
- * enqueue guidance automatically points at it when present in the registry).
+ * it as `get-code-execution` give the model a dedicated volatile read tool (and
+ * the enqueue guidance automatically points at it when present in the
+ * registry). Keep the opt-out here rather than on `run-code`: repeated normal
+ * run-code calls may execute writes or outbound requests and must retain the
+ * agent loop's default duplicate-call protection.
  */
 export function createGetCodeExecutionEntry(): ActionEntry {
   return {
     readOnly: true,
+    // Polling with an identical executionId is the intended usage — the
+    // status changes over time, so this must not be deduped.
+    dedupe: false,
     tool: {
       description:
         "Check a background run-code execution: returns its status (queued | running | succeeded | failed | timed_out) and, once finished, its stdout/stderr output. Executions are scoped to the user who started them. While one is queued or running, continue other useful work and poll every ~15-30 seconds instead of busy-waiting.",

package/corpus/core/src/deploy/build.ts

@@ -2535,17 +2535,18 @@ function walkServerJavaScriptFiles(
 }
 
 /**
- * Nitro can preserve Vite's `yjs` external in a split server chunk even when
- * its own server build has emitted `_libs/yjs.mjs`. Netlify does not install
- * that bare package at runtime, so make every emitted server chunk use the
- * bundled copy before its function is packaged.
+ * Nitro receives the React Router SSR build as prebuilt chunks, so its normal
+ * dependency resolver cannot reliably fold the preserved bare `yjs` imports
+ * into the same module instance used by core's server collaboration code.
+ * Keep Yjs external through Nitro, bundle its complete public ESM surface once,
+ * then point every emitted server chunk at that one portable runtime module.
  */
-export function rewriteBareYjsImportsForServerlessOutput(
+export function bundleYjsRuntimeForServerlessOutput(
   serverDir: string,
+  projectCwd: string,
 ): string[] {
   const bareImports: string[] = [];
   const unsupportedSubpathImports: string[] = [];
-  const bundledYjsPath = path.join(serverDir, "_libs", "yjs.mjs");
 
   walkServerJavaScriptFiles(serverDir, (filePath) => {
     const source = fs.readFileSync(filePath, "utf-8");
@@ -2563,11 +2564,22 @@ export function rewriteBareYjsImportsForServerlessOutput(
     );
   }
   if (bareImports.length === 0) return [];
-  if (!fs.existsSync(bundledYjsPath)) {
-    throw new Error(
-      `[deploy] Serverless output left yjs as a runtime import but did not emit ${bundledYjsPath}`,
-    );
-  }
+
+  const bundledYjsPath = path.join(serverDir, "_libs", "yjs-runtime.mjs");
+  fs.mkdirSync(path.dirname(bundledYjsPath), { recursive: true });
+  execFileSync(
+    findEsbuild(),
+    [
+      resolveNitroBundledYjsEntry(),
+      "--bundle",
+      "--format=esm",
+      "--platform=node",
+      "--target=node22",
+      "--minify",
+      `--outfile=${bundledYjsPath}`,
+    ],
+    { cwd: projectCwd, stdio: "pipe" },
+  );
 
   for (const filePath of bareImports) {
     const bundledImport = path
@@ -2702,6 +2714,26 @@ export function assertSingleTemplateNetlifyBuildOutput(
     );
   }
 
+  // Nitro's `_libs/yjs.mjs` is a private tree-shaken chunk, not a package
+  // facade. Repointing a prebuilt SSR chunk at it can request public exports
+  // (notably `Text`) that the private chunk did not retain. The controlled
+  // serverless pass must instead target the complete `yjs-runtime.mjs` bundle.
+  const privateYjsImports: string[] = [];
+  walkServerJavaScriptFiles(serverDir, (filePath) => {
+    if (
+      /\b(?:from\s*|import\s*\(\s*|import\s*)(["'])[^"']*_libs\/yjs\.mjs\1/.test(
+        fs.readFileSync(filePath, "utf-8"),
+      )
+    ) {
+      privateYjsImports.push(path.relative(projectCwd, filePath));
+    }
+  });
+  if (privateYjsImports.length > 0) {
+    failures.push(
+      `Netlify server bundle imports Nitro's internal tree-shaken _libs/yjs.mjs: ${privateYjsImports.join(", ")}`,
+    );
+  }
+
   if (isDurableBackgroundDeployEnabled()) {
     const backgroundDir = path.join(
       internalDir,
@@ -3153,18 +3185,27 @@ const BROWSER_ONLY_SERVER_LIBS = [
 ];
 
 /**
- * Dependencies that must be bundled into every Nitro server output instead of
- * being left as runtime package imports.
- *
- * `yjs` is a direct core dependency, but it is deliberately externalized from
- * the intermediate Vite SSR graph so that Vite and Nitro do not create two
- * incompatible Yjs constructors. On file-traced serverless presets, leaving it
- * external at Nitro's final build can emit `import "yjs"` into a function
- * chunk without placing the package in that function's `node_modules`. Bundle
- * it in Nitro's final output so every template receives the one portable copy.
+ * Dependencies Nitro itself must bundle outside the controlled serverless
+ * output pass. Netlify, Vercel, and Lambda keep Yjs external through Nitro;
+ * `bundleYjsRuntimeForServerlessOutput` then creates their one portable copy.
  */
 export const NITRO_SERVER_RUNTIME_BUNDLED_DEPS = ["yjs"] as const;
 
+/**
+ * Locate the core-owned ESM entry used by the controlled serverless bundling
+ * pass. Resolving from this module keeps the build independent of whether a
+ * template exposes core's transitive Yjs dependency at its own package root.
+ */
+export function resolveNitroBundledYjsEntry(): string {
+  const requireFromCore = createRequire(import.meta.url);
+  const packageDir = path.dirname(requireFromCore.resolve("yjs/package.json"));
+  const entry = path.join(packageDir, "dist", "yjs.mjs");
+  if (!fs.existsSync(entry)) {
+    throw new Error(`[build] Could not resolve the Yjs ESM entry at ${entry}`);
+  }
+  return entry;
+}
+
 /**
  * Edge runtimes have no node_modules, while Node/serverless outputs only need
  * the small set above bundled to keep their package manifests traceable.
@@ -3175,7 +3216,11 @@ export function nitroNoExternalsForPreset(
   return targetPreset.startsWith("cloudflare") ||
     targetPreset.startsWith("deno")
     ? true
-    : NITRO_SERVER_RUNTIME_BUNDLED_DEPS;
+    : targetPreset === "netlify" ||
+        targetPreset === "vercel" ||
+        targetPreset === "aws-lambda"
+      ? []
+      : NITRO_SERVER_RUNTIME_BUNDLED_DEPS;
 }
 
 /**
@@ -3327,6 +3372,14 @@ export default bundle;
     // (ReferenceError: window is not defined → every request 502s). Mirrors the
     // Vite `ssrStubPlugin`, which only covers the `build/server` step.
     rollupConfig: {
+      // Nitro treats the intermediate React Router SSR files as prebuilt
+      // chunks, while core's server collaboration files participate in the
+      // final Rolldown graph. Externalize Yjs consistently on serverless so
+      // both graphs retain their public import shapes; the controlled
+      // post-build pass below bundles and rewrites them to one module.
+      ...(preset === "netlify" || preset === "vercel" || preset === "aws-lambda"
+        ? { external: ["yjs"] }
+        : {}),
       plugins: [createBrowserOnlyServerStubPlugin()],
     },
     ...(providedPluginsNitroPlugin
@@ -3334,9 +3387,9 @@ export default bundle;
       : {}),
     routeRules: mcpEmbedStaticAssetRouteRules(appBasePath),
     // Edge presets (cloudflare, deno) bundle all deps because node_modules are
-    // unavailable at runtime. Node/serverless presets also bundle Yjs: Nitro's
-    // file tracer otherwise leaves a bare import that Netlify function bundles
-    // cannot resolve under pnpm.
+    // unavailable at runtime. Ordinary Node presets bundle Yjs through Nitro.
+    // Controlled serverless presets externalize it above, then emit one full
+    // runtime module after Nitro has preserved every consumer's public imports.
     noExternals: nitroNoExternalsForPreset(preset),
   } as any);
 
@@ -3354,7 +3407,7 @@ export default bundle;
     copyInstalledResvgPackages(nitro.options.output.serverDir);
     copyInstalledFfmpegStaticPackage(nitro.options.output.serverDir);
     sanitizeServerlessFunctionPackageManifest(nitro.options.output.serverDir);
-    rewriteBareYjsImportsForServerlessOutput(nitro.options.output.serverDir);
+    bundleYjsRuntimeForServerlessOutput(nitro.options.output.serverDir, cwd);
   }
 
   // Durable background agent runs (default-OFF / opt-in; enable with a truthy

package/corpus/core/src/extensions/actions.ts

@@ -44,6 +44,15 @@ import {
   type ExtensionRow,
 } from "./store.js";
 
+// A 200k extension body containing JSON-sensitive HTML/JS characters (quotes,
+// backslashes, and newlines) expands to about 400k characters when pretty-JSON
+// serialized by the agent loop. A history detail can carry the current and
+// previous bodies plus both bodies again in its line diff (about 1.6M chars in
+// the same worst-common-case fixture). These caps add roughly 25% headroom for
+// the surrounding metadata and indentation while still bounding tool context.
+const GET_EXTENSION_MAX_RESULT_CHARS = 500_000;
+const GET_EXTENSION_HISTORY_MAX_RESULT_CHARS = 2_000_000;
+
 export function createExtensionActionEntries(): Record<string, ActionEntry> {
   return {
     "list-extensions": {
@@ -185,6 +194,9 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
           ),
         };
       },
+      // Result is JSON including the full Alpine content; account for JSON
+      // escaping and envelope metadata instead of matching the source cap.
+      maxResultChars: GET_EXTENSION_MAX_RESULT_CHARS,
       readOnly: true,
     },
 
@@ -276,6 +288,9 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
           ),
         };
       },
+      // With includeContent, history can contain current + previous source and
+      // repeat both in the diff, so it needs more headroom than get-extension.
+      maxResultChars: GET_EXTENSION_HISTORY_MAX_RESULT_CHARS,
       readOnly: true,
     },
 

package/corpus/core/src/extensions/url-safety.ts

@@ -251,17 +251,27 @@ export async function createSsrfSafeDispatcher(): Promise<unknown | null> {
  * `httpsOnly` extends the per-hop validation to the URL scheme: redirects are
  * followed only to `https:` targets, so an HTTPS-only caller cannot be
  * downgraded to plain HTTP by a 30x from the (untrusted) origin.
+ *
+ * `assertUrlAllowed` lets callers layer a stricter destination policy (for
+ * example, a credential's origin allowlist) on top of the SSRF checks. It runs
+ * before the initial request and before every redirect hop, so sensitive
+ * headers and bodies are never forwarded to a destination the caller rejects.
  */
 export async function ssrfSafeFetch(
   url: string,
   init: RequestInit = {},
-  options: { maxRedirects?: number; httpsOnly?: boolean } = {},
+  options: {
+    maxRedirects?: number;
+    httpsOnly?: boolean;
+    assertUrlAllowed?: (url: string) => void | Promise<void>;
+  } = {},
 ): Promise<Response> {
   const maxRedirects = options.maxRedirects ?? 3;
   const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;
 
   let currentUrl = url;
   for (let hop = 0; hop <= maxRedirects; hop++) {
+    await options.assertUrlAllowed?.(currentUrl);
     if (options.httpsOnly && new URL(currentUrl).protocol !== "https:") {
       throw new Error(
         `SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`,

package/corpus/core/src/notifications/channels.ts

@@ -29,9 +29,10 @@
 
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
 import {
+  getKeyAllowlist,
+  getResolvedKeyAllowlist,
   resolveKeyReferencesWithRequestScopes,
   validateUrlAllowlist,
-  getKeyAllowlist,
 } from "../secrets/substitution.js";
 import { sendEmail } from "../server/email.js";
 import { registerNotificationChannel } from "./registry.js";
@@ -72,7 +73,7 @@ function createWebhookChannel(
       // No-op when neither a per-notification nor workspace URL is set —
       // mirrors email's empty-recipients behavior so notify-all stays quiet.
       if (!urlTemplate) return false;
-      const { url, headers } = await resolveWebhookRequest(
+      const { url, headers, assertUrlAllowed } = await resolveWebhookRequest(
         urlTemplate,
         overrideUrlTemplate ? undefined : authTemplate,
         meta.owner,
@@ -92,7 +93,7 @@ function createWebhookChannel(
             emittedAt: new Date().toISOString(),
           }),
         },
-        { maxRedirects: 3 },
+        { maxRedirects: 3, assertUrlAllowed },
       );
       if (!res.ok) {
         throw new Error(
@@ -121,7 +122,7 @@ function createSlackWebhookChannel(
         metadataString(input.metadata, "slackWebhookUrl") ??
         envUrlTemplate?.trim();
       if (!urlTemplate) return false;
-      const { url, headers } = await resolveWebhookRequest(
+      const { url, headers, assertUrlAllowed } = await resolveWebhookRequest(
         urlTemplate,
         overrideUrlTemplate ? undefined : authTemplate,
         meta.owner,
@@ -165,7 +166,7 @@ function createSlackWebhookChannel(
             ],
           }),
         },
-        { maxRedirects: 3 },
+        { maxRedirects: 3, assertUrlAllowed },
       );
       if (!res.ok) {
         throw new Error(
@@ -214,7 +215,11 @@ async function resolveWebhookRequest(
   authTemplate: string | undefined,
   owner: string,
   label: string,
-): Promise<{ url: string; headers: Record<string, string> }> {
+): Promise<{
+  url: string;
+  headers: Record<string, string>;
+  assertUrlAllowed: (url: string) => void;
+}> {
   // Resolve `${keys.NAME}` references through the same request-scope
   // cascade already used by extension fetches (extensions/routes.ts) and
   // automation connector headers (automation/index.ts): user scope first
@@ -229,46 +234,72 @@ async function resolveWebhookRequest(
   // strict superset of the previous user-scope-only behavior.
   // Missing keys throw — the error surfaces in logs and the channel is marked
   // un-delivered, but other channels still run.
-  const { resolved: url } = await resolveKeyReferencesWithRequestScopes(
+  const urlResult = await resolveKeyReferencesWithRequestScopes(
     urlTemplate,
     owner,
   );
+  const url = urlResult.resolved;
   const headers: Record<string, string> = {
     "Content-Type": "application/json",
   };
+  let authResult:
+    | Awaited<ReturnType<typeof resolveKeyReferencesWithRequestScopes>>
+    | undefined;
   if (authTemplate) {
-    const { resolved: auth } = await resolveKeyReferencesWithRequestScopes(
+    authResult = await resolveKeyReferencesWithRequestScopes(
       authTemplate,
       owner,
     );
-    headers.Authorization = auth;
+    headers.Authorization = authResult.resolved;
   }
 
   // If the user set an allowlist on a referenced key, enforce it here —
   // origin-level check, same rule the automations fetch-tool applies.
-  // NOTE: this still checks the allowlist at user scope only (unlike the
-  // fetch tool's validateUrl, which now consults getResolvedKeyAllowlist at
-  // the scope the key actually resolved at — see agent-chat-plugin.ts). A
-  // key that resolves at org/workspace scope with an allowlist configured
-  // on that org/workspace row will not have it enforced here.
-  const keyNames = Array.from(
-    new Set(
-      Array.from(urlTemplate.matchAll(/\$\{keys\.([A-Za-z0-9_-]+)\}/g), (m) =>
-        String(m[1]),
-      ),
-    ),
-  );
-  const allowlists = await Promise.all(
-    keyNames.map((name) => getKeyAllowlist(name, "user", owner)),
-  );
-  keyNames.forEach((name, i) => {
-    if (!validateUrlAllowlist(url, allowlists[i])) {
-      throw new Error(
-        `[notifications] ${label} URL ${new URL(url).origin} is not in the allowlist for key "${name}"`,
+  // Validate URL and Authorization keys independently so an allowlisted auth
+  // token cannot be sent to a metadata-provided destination. Keep scope in the
+  // dedupe key because the same key name can resolve at a different scope if a
+  // credential changes between the two substitutions.
+  type ResolvedKey = NonNullable<typeof urlResult.resolvedKeys>[number];
+  const keyUsages = new Map<
+    string,
+    { name: string; resolvedKey?: ResolvedKey }
+  >();
+  for (const result of authResult ? [urlResult, authResult] : [urlResult]) {
+    for (const name of result.usedKeys) {
+      const resolved = (result.resolvedKeys ?? []).filter(
+        (ref) => ref.name === name,
       );
+      if (resolved.length === 0) {
+        keyUsages.set(`user:${owner}:${name}`, { name });
+        continue;
+      }
+      for (const resolvedKey of resolved) {
+        keyUsages.set(`${resolvedKey.scope}:${resolvedKey.scopeId}:${name}`, {
+          name,
+          resolvedKey,
+        });
+      }
     }
-  });
-  return { url, headers };
+  }
+  const usages = Array.from(keyUsages.values());
+  const allowlists = await Promise.all(
+    usages.map(({ name, resolvedKey }) =>
+      resolvedKey
+        ? getResolvedKeyAllowlist(resolvedKey)
+        : getKeyAllowlist(name, "user", owner),
+    ),
+  );
+  const assertUrlAllowed = (candidateUrl: string): void => {
+    usages.forEach(({ name }, i) => {
+      if (!validateUrlAllowlist(candidateUrl, allowlists[i])) {
+        throw new Error(
+          `[notifications] ${label} URL ${new URL(candidateUrl).origin} is not in the allowlist for key "${name}"`,
+        );
+      }
+    });
+  };
+  assertUrlAllowed(url);
+  return { url, headers, assertUrlAllowed };
 }
 
 function metadataString(