@agent-native/core 0.12.17 → 0.12.18

package/dist/agent/engine/index.d.ts

@@ -2,7 +2,7 @@
  * Public exports for the pluggable agent engine system.
  */
 export type { AgentEngine, EngineCapabilities, EngineTool, EngineMessage, EngineContentPart, EngineTextPart, EngineImagePart, EngineToolCallPart, EngineToolResultPart, EngineThinkingPart, EngineEvent, EngineStreamOptions, } from "./types.js";
-export { registerAgentEngine, getAgentEngineEntry, listAgentEngines, resolveEngine, getStoredModelForEngine, detectEngineFromEnv, detectEngineFromUserSecrets, isAgentEngineSettingConfigured, isStoredEngineUsable, type AgentEngineEntry, type ResolveEngineConfig, } from "./registry.js";
+export { registerAgentEngine, getAgentEngineEntry, listAgentEngines, resolveEngine, getStoredModelForEngine, detectEngineFromEnv, detectEngineFromUserSecrets, isAgentEngineSettingConfigured, isStoredEngineUsable, isStoredEngineUsableForRequest, type AgentEngineEntry, type ResolveEngineConfig, } from "./registry.js";
 export { createBuilderEngine, BUILDER_DEFAULT_MODEL, BUILDER_SUPPORTED_MODELS, BUILDER_CAPABILITIES, } from "./builder-engine.js";
 export { createAnthropicEngine, ANTHROPIC_DEFAULT_MODEL, ANTHROPIC_SUPPORTED_MODELS, ANTHROPIC_CAPABILITIES, } from "./anthropic-engine.js";
 export { createAISDKEngine, type AISDKProvider } from "./ai-sdk-engine.js";

package/dist/agent/engine/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/agent/engine/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,8BAA8B,EAC9B,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/agent/engine/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,8BAA8B,EAC9B,oBAAoB,EACpB,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC"}

package/dist/agent/engine/index.js

@@ -1,7 +1,7 @@
 /**
  * Public exports for the pluggable agent engine system.
  */
-export { registerAgentEngine, getAgentEngineEntry, listAgentEngines, resolveEngine, getStoredModelForEngine, detectEngineFromEnv, detectEngineFromUserSecrets, isAgentEngineSettingConfigured, isStoredEngineUsable, } from "./registry.js";
+export { registerAgentEngine, getAgentEngineEntry, listAgentEngines, resolveEngine, getStoredModelForEngine, detectEngineFromEnv, detectEngineFromUserSecrets, isAgentEngineSettingConfigured, isStoredEngineUsable, isStoredEngineUsableForRequest, } from "./registry.js";
 export { createBuilderEngine, BUILDER_DEFAULT_MODEL, BUILDER_SUPPORTED_MODELS, BUILDER_CAPABILITIES, } from "./builder-engine.js";
 export { createAnthropicEngine, ANTHROPIC_DEFAULT_MODEL, ANTHROPIC_SUPPORTED_MODELS, ANTHROPIC_CAPABILITIES, } from "./anthropic-engine.js";
 export { createAISDKEngine } from "./ai-sdk-engine.js";

package/dist/agent/engine/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/agent/engine/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAiBH,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,8BAA8B,EAC9B,oBAAoB,GAGrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAsB,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC","sourcesContent":["/**\n * Public exports for the pluggable agent engine system.\n */\n\nexport type {\n  AgentEngine,\n  EngineCapabilities,\n  EngineTool,\n  EngineMessage,\n  EngineContentPart,\n  EngineTextPart,\n  EngineImagePart,\n  EngineToolCallPart,\n  EngineToolResultPart,\n  EngineThinkingPart,\n  EngineEvent,\n  EngineStreamOptions,\n} from \"./types.js\";\n\nexport {\n  registerAgentEngine,\n  getAgentEngineEntry,\n  listAgentEngines,\n  resolveEngine,\n  getStoredModelForEngine,\n  detectEngineFromEnv,\n  detectEngineFromUserSecrets,\n  isAgentEngineSettingConfigured,\n  isStoredEngineUsable,\n  type AgentEngineEntry,\n  type ResolveEngineConfig,\n} from \"./registry.js\";\n\nexport {\n  createBuilderEngine,\n  BUILDER_DEFAULT_MODEL,\n  BUILDER_SUPPORTED_MODELS,\n  BUILDER_CAPABILITIES,\n} from \"./builder-engine.js\";\n\nexport {\n  createAnthropicEngine,\n  ANTHROPIC_DEFAULT_MODEL,\n  ANTHROPIC_SUPPORTED_MODELS,\n  ANTHROPIC_CAPABILITIES,\n} from \"./anthropic-engine.js\";\nexport { createAISDKEngine, type AISDKProvider } from \"./ai-sdk-engine.js\";\nexport { registerBuiltinEngines } from \"./builtin.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/agent/engine/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAiBH,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,8BAA8B,EAC9B,oBAAoB,EACpB,8BAA8B,GAG/B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAsB,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC","sourcesContent":["/**\n * Public exports for the pluggable agent engine system.\n */\n\nexport type {\n  AgentEngine,\n  EngineCapabilities,\n  EngineTool,\n  EngineMessage,\n  EngineContentPart,\n  EngineTextPart,\n  EngineImagePart,\n  EngineToolCallPart,\n  EngineToolResultPart,\n  EngineThinkingPart,\n  EngineEvent,\n  EngineStreamOptions,\n} from \"./types.js\";\n\nexport {\n  registerAgentEngine,\n  getAgentEngineEntry,\n  listAgentEngines,\n  resolveEngine,\n  getStoredModelForEngine,\n  detectEngineFromEnv,\n  detectEngineFromUserSecrets,\n  isAgentEngineSettingConfigured,\n  isStoredEngineUsable,\n  isStoredEngineUsableForRequest,\n  type AgentEngineEntry,\n  type ResolveEngineConfig,\n} from \"./registry.js\";\n\nexport {\n  createBuilderEngine,\n  BUILDER_DEFAULT_MODEL,\n  BUILDER_SUPPORTED_MODELS,\n  BUILDER_CAPABILITIES,\n} from \"./builder-engine.js\";\n\nexport {\n  createAnthropicEngine,\n  ANTHROPIC_DEFAULT_MODEL,\n  ANTHROPIC_SUPPORTED_MODELS,\n  ANTHROPIC_CAPABILITIES,\n} from \"./anthropic-engine.js\";\nexport { createAISDKEngine, type AISDKProvider } from \"./ai-sdk-engine.js\";\nexport { registerBuiltinEngines } from \"./builtin.js\";\n"]}

package/dist/agent/engine/registry.d.ts

@@ -86,6 +86,15 @@ export declare function isAgentEngineSettingConfigured(stored: unknown): boolean
  * `isAgentEngineSettingConfigured`.
  */
 export declare function isStoredEngineUsable(stored: unknown, entry: AgentEngineEntry): boolean;
+/**
+ * Request-aware version of `isStoredEngineUsable`.
+ *
+ * The settings row stores the selected engine/model, while credentials may
+ * live in per-user/org `app_secrets`. The sync helper intentionally only sees
+ * deploy env vars; this async helper is what request-time routes should use
+ * when deciding whether a stored engine can actually run for the current user.
+ */
+export declare function isStoredEngineUsableForRequest(stored: unknown, entry: AgentEngineEntry): Promise<boolean>;
 export interface ResolveEngineConfig {
     /** Explicit engine name or instance from createAgentChatPlugin options */
     engineOption?: string | AgentEngine | {
@@ -98,13 +107,16 @@ export interface ResolveEngineConfig {
     model?: string;
 }
 /**
- * Resolve an AgentEngine from options → settings → env → default.
+ * Resolve an AgentEngine from options → explicit env → request credentials →
+ * settings → env → default.
  *
  * Resolution order:
  * 1. Explicit `engineOption` from plugin options (string name, instance, or {name, config})
- * 2. Settings store key "agent-engine" → { engine: string }
- * 3. Env var AGENT_ENGINE
- * 4. Default "anthropic" (requires ANTHROPIC_API_KEY)
+ * 2. Env var AGENT_ENGINE
+ * 3. Current request's app_secrets; Builder wins by default when connected
+ * 4. Settings store key "agent-engine" → { engine: string }, when usable
+ * 5. Auto-detect deployment env credentials
+ * 6. Default "anthropic" (requires ANTHROPIC_API_KEY)
  */
 export declare function resolveEngine(config: ResolveEngineConfig): Promise<AgentEngine>;
 /**

package/dist/agent/engine/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/agent/engine/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAEnB,MAAM,YAAY,CAAC;AAOpB,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0BAA0B;IAC1B,YAAY,EAAE,kBAAkB,CAAC;IACjC,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,6DAA6D;IAC7D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,4CAA4C;IAC5C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAAC;CACtD;AAID;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAajE;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,GACX,gBAAgB,GAAG,SAAS,CAE9B;AAED,yCAAyC;AACzC,wBAAgB,gBAAgB,IAAI,gBAAgB,EAAE,CAErD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,IAAI,CAuB7D;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAuCpF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAOvE;AAUD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAIT;AAED,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EACT,MAAM,GACN,WAAW,GACX;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAqFtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,WAAW,GAAG,MAAM,GAC3B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/agent/engine/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAEnB,MAAM,YAAY,CAAC;AAOpB,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0BAA0B;IAC1B,YAAY,EAAE,kBAAkB,CAAC;IACjC,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,6DAA6D;IAC7D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,4CAA4C;IAC5C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAAC;CACtD;AAID;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAajE;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,GACX,gBAAgB,GAAG,SAAS,CAE9B;AAED,yCAAyC;AACzC,wBAAgB,gBAAgB,IAAI,gBAAgB,EAAE,CAErD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,IAAI,CAuB7D;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAuCpF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAOvE;AAUD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAIT;AAED;;;;;;;GAOG;AACH,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EACT,MAAM,GACN,WAAW,GACX;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAgGtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,WAAW,GAAG,MAAM,GAC3B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B"}

package/dist/agent/engine/registry.js

@@ -165,13 +165,42 @@ export function isStoredEngineUsable(stored, entry) {
     return entry.requiredEnvVars.every((v) => !!readDeployCredentialEnv(v));
 }
 /**
- * Resolve an AgentEngine from options → settings → env → default.
+ * Request-aware version of `isStoredEngineUsable`.
+ *
+ * The settings row stores the selected engine/model, while credentials may
+ * live in per-user/org `app_secrets`. The sync helper intentionally only sees
+ * deploy env vars; this async helper is what request-time routes should use
+ * when deciding whether a stored engine can actually run for the current user.
+ */
+export async function isStoredEngineUsableForRequest(stored, entry) {
+    if (isAgentEngineSettingConfigured(stored))
+        return true;
+    if (entry.requiredEnvVars.length === 0)
+        return true;
+    for (const key of entry.requiredEnvVars) {
+        try {
+            if (await resolveSecret(key))
+                continue;
+        }
+        catch {
+            // Fall through to the deployment-level check below.
+        }
+        if (!readDeployCredentialEnv(key))
+            return false;
+    }
+    return true;
+}
+/**
+ * Resolve an AgentEngine from options → explicit env → request credentials →
+ * settings → env → default.
  *
  * Resolution order:
  * 1. Explicit `engineOption` from plugin options (string name, instance, or {name, config})
- * 2. Settings store key "agent-engine" → { engine: string }
- * 3. Env var AGENT_ENGINE
- * 4. Default "anthropic" (requires ANTHROPIC_API_KEY)
+ * 2. Env var AGENT_ENGINE
+ * 3. Current request's app_secrets; Builder wins by default when connected
+ * 4. Settings store key "agent-engine" → { engine: string }, when usable
+ * 5. Auto-detect deployment env credentials
+ * 6. Default "anthropic" (requires ANTHROPIC_API_KEY)
  */
 export async function resolveEngine(config) {
     const { engineOption, apiKey, model: _model } = config;
@@ -198,34 +227,41 @@ export async function resolveEngine(config) {
             throw new Error(`[agent-engine] Unknown engine: "${engineOption}". Registered: ${[..._registry.keys()].join(", ")}`);
         return entry.create({ apiKey });
     }
-    // 4. Settings store — only when the stored row's API key is reachable.
-    try {
-        const stored = await getSetting("agent-engine");
-        if (stored && typeof stored.engine === "string") {
-            const entry = _registry.get(stored.engine);
-            if (entry && isStoredEngineUsable(stored, entry)) {
-                return entry.create({
-                    apiKey,
-                    ...stripInlineApiKeyConfig(stored.config),
-                });
-            }
-        }
-    }
-    catch {
-        // Settings not available — fall through
-    }
-    // 5. Env var — explicit engine name override
+    // 4. Env var — explicit engine name override
     const envEngine = process.env.AGENT_ENGINE;
     if (envEngine) {
         const entry = _registry.get(envEngine);
         if (entry)
             return entry.create({ apiKey });
     }
-    // 6. Auto-detect from the current user's per-user `app_secrets` rows
+    let stored = null;
+    try {
+        stored = (await getSetting("agent-engine"));
+    }
+    catch {
+        // Settings not available — fall through
+    }
+    // 5. Auto-detect from the current user's per-user `app_secrets` rows
     // (Builder OAuth callback + "paste your own key" settings flow write
     // here, not env). Comes before env-detection so a user-specific
-    // connection wins over a stale deploy-level key.
+    // Builder connection wins over a stale deploy-level/provider key.
     const detectedFromUser = await detectEngineFromUserSecrets();
+    if (detectedFromUser?.name === "builder") {
+        return detectedFromUser.create({ apiKey });
+    }
+    // 6. Settings store — only when the stored row's API key is reachable.
+    // This remains below Builder detection so "Builder.io connected" and the
+    // runtime agree on the default managed gateway path. Non-Builder user keys
+    // still honor the stored provider/model when Builder is not connected.
+    if (stored && typeof stored.engine === "string") {
+        const entry = _registry.get(stored.engine);
+        if (entry && (await isStoredEngineUsableForRequest(stored, entry))) {
+            return entry.create({
+                apiKey,
+                ...stripInlineApiKeyConfig(stored.config),
+            });
+        }
+    }
     if (detectedFromUser)
         return detectedFromUser.create({ apiKey });
     // 8. Auto-detect from any provider env var — so just dropping a key in

package/dist/agent/engine/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/agent/engine/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,aAAa,GACd,MAAM,qCAAqC,CAAC;AAuB7C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;AAEtD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAuB;IACzD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,+DAA+D;QAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACpC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CACV,0BAA0B,KAAK,CAAC,IAAI,oCAAoC,CACzE,CAAC;QACF,OAAO;IACT,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CACjC,IAAY;IAEZ,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAClC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAC9C,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YACvC,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACjD,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,oEAAoE;IACtE,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjD,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAClD,KAAK,GAAG,mBAAmB,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,UAAU,GAAG,KAAK,EAAE,KAAuB,EAAoB,EAAE;QACrE,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAClC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAC9C,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YACvC,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC5C,CAAC;QACD,oEAAoE;IACtE,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAe;IAC5D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,CAAC,GAAG,MAET,CAAC;IACF,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAA2C;IAE3C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;IAC3D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAe,EACf,KAAuB;IAEvB,IAAI,8BAA8B,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAcD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAEvD,uCAAuC;IACvC,IACE,YAAY;QACZ,OAAO,YAAY,KAAK,QAAQ;QAChC,QAAQ,IAAI,YAAY,EACxB,CAAC;QACD,OAAO,YAA2B,CAAC;IACrC,CAAC;IAED,oCAAoC;IACpC,IACE,YAAY;QACZ,OAAO,YAAY,KAAK,QAAQ;QAChC,MAAM,IAAI,YAAY,EACtB,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,YAGtC,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,kBAAkB,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5F,CAAC;QACJ,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,uCAAuC;IACvC,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,KAAK,CACb,mCAAmC,YAAY,kBAAkB,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpG,CAAC;QACJ,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;QAChD,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,KAAK,IAAI,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;gBACjD,OAAO,KAAK,CAAC,MAAM,CAAC;oBAClB,MAAM;oBACN,GAAG,uBAAuB,CACxB,MAAM,CAAC,MAA6C,CACrD;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IAED,6CAA6C;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC3C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,iDAAiD;IACjD,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,EAAE,CAAC;IAC7D,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAEjE,uEAAuE;IACvE,gDAAgD;IAChD,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAEjD,wBAAwB;IACxB,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAA4B;IAE5B,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;QAChD,IACE,MAAM;YACN,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,MAAM,CAAC,MAAM,KAAK,UAAU;YAC5B,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EACvB,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * Agent Engine Registry.\n *\n * Mirrors the CLI_REGISTRY pattern (packages/core/src/terminal/cli-registry.ts)\n * but is open — anyone can register a custom engine via registerAgentEngine()\n * from a server plugin at startup.\n *\n * Built-in engines (anthropic, ai-sdk) are auto-registered by builtin.ts.\n */\n\nimport type {\n  AgentEngine,\n  EngineCapabilities,\n  EngineStreamOptions,\n} from \"./types.js\";\nimport { getSetting } from \"../../settings/store.js\";\nimport {\n  readDeployCredentialEnv,\n  resolveSecret,\n} from \"../../server/credential-provider.js\";\n\nexport interface AgentEngineEntry {\n  /** Unique name, e.g. \"anthropic\", \"ai-sdk:anthropic\", \"ai-sdk:openai\" */\n  name: string;\n  /** Human-readable label for UI */\n  label: string;\n  /** Short description for engine picker */\n  description: string;\n  /** npm package hint displayed in UI when package is missing */\n  installPackage?: string;\n  /** Engine capabilities */\n  capabilities: EngineCapabilities;\n  /** Default model string */\n  defaultModel: string;\n  /** All supported models (shown in model picker) */\n  supportedModels: readonly string[];\n  /** Environment variables required for this engine to work */\n  requiredEnvVars: string[];\n  /** Create an engine instance from config */\n  create(config: Record<string, unknown>): AgentEngine;\n}\n\nconst _registry = new Map<string, AgentEngineEntry>();\n\n/**\n * Register a custom agent engine. Called at server startup (e.g., from a\n * server plugin or builtin.ts). Throws if name is already registered.\n */\nexport function registerAgentEngine(entry: AgentEngineEntry): void {\n  if (_registry.has(entry.name)) {\n    // Allow re-registration in tests / hot-reload — just overwrite\n    if (process.env.NODE_ENV === \"test\") {\n      _registry.set(entry.name, entry);\n      return;\n    }\n    console.warn(\n      `[agent-engine] Engine \"${entry.name}\" is already registered. Skipping.`,\n    );\n    return;\n  }\n  _registry.set(entry.name, entry);\n}\n\n/** Get a registered engine entry by name, or undefined if not found */\nexport function getAgentEngineEntry(\n  name: string,\n): AgentEngineEntry | undefined {\n  return _registry.get(name);\n}\n\n/** List all registered engine entries */\nexport function listAgentEngines(): AgentEngineEntry[] {\n  return Array.from(_registry.values());\n}\n\n/**\n * First registered engine whose requiredEnvVars are all set. Registration\n * order controls priority — the Builder gateway is registered first so it\n * wins when the Builder private key is present.\n *\n * Escape hatch: AGENT_ENGINE_PREFER_BYO_KEY=true skips the Builder engine\n * on the first pass, so an explicit provider key (ANTHROPIC_API_KEY etc.)\n * is picked instead. Builder is still used as the fallback when no other\n * provider key is set.\n */\nexport function detectEngineFromEnv(): AgentEngineEntry | null {\n  const preferByo = /^(1|true)$/i.test(\n    process.env.AGENT_ENGINE_PREFER_BYO_KEY ?? \"\",\n  );\n\n  if (preferByo) {\n    for (const entry of _registry.values()) {\n      if (entry.name === \"builder\") continue;\n      if (entry.requiredEnvVars.length === 0) continue;\n      if (entry.requiredEnvVars.every((v) => !!readDeployCredentialEnv(v))) {\n        return entry;\n      }\n    }\n    // No BYO key matched — fall through to include Builder as fallback.\n  }\n\n  for (const entry of _registry.values()) {\n    if (entry.requiredEnvVars.length === 0) continue;\n    if (entry.requiredEnvVars.every((v) => !!readDeployCredentialEnv(v))) {\n      return entry;\n    }\n  }\n  return null;\n}\n\n/**\n * Detect a usable engine from the current request user's accessible\n * `app_secrets` rows. Mirrors `detectEngineFromEnv` but consults the\n * encrypted secret store instead of `process.env`, including org-scoped\n * credentials shared with the active organization.\n *\n * Required because the Builder OAuth callback (and the settings UI's\n * \"paste your own key\" flow) writes credentials to app_secrets, not env.\n * Without this check, a user who connected Builder would see status\n * \"configured\" but the next chat turn would fall through to the default\n * Anthropic engine and hit `missing_api_key` — exactly Brent's symptom\n * on the docs site (Loom 2026-04-28: \"It doesn't seem to realize I'm\n * connected once I do a chat\").\n *\n * Includes the local dev session (`local@localhost`): the Builder\n * OAuth flow writes credentials scoped to that email when run from\n * `pnpm dev`, so detection has to consult those rows or the dev user\n * sees the same \"Connect your AI\" card after they've already connected\n * (Sami, 2026-04-30). Org-scoped Builder credentials must also count here:\n * `/builder/status` resolves them via the same request org context, and the\n * chat engine picker must not disagree with that card.\n */\nexport async function detectEngineFromUserSecrets(): Promise<AgentEngineEntry | null> {\n  let email: string | undefined;\n  try {\n    const { getRequestUserEmail } =\n      await import(\"../../server/request-context.js\");\n    email = getRequestUserEmail();\n  } catch {\n    return null;\n  }\n  if (!email) return null;\n\n  const hasAllKeys = async (entry: AgentEngineEntry): Promise<boolean> => {\n    if (entry.requiredEnvVars.length === 0) return false;\n    for (const key of entry.requiredEnvVars) {\n      try {\n        if (!(await resolveSecret(key))) return false;\n      } catch {\n        return false;\n      }\n    }\n    return true;\n  };\n\n  const preferByo = /^(1|true)$/i.test(\n    process.env.AGENT_ENGINE_PREFER_BYO_KEY ?? \"\",\n  );\n\n  if (preferByo) {\n    for (const entry of _registry.values()) {\n      if (entry.name === \"builder\") continue;\n      if (await hasAllKeys(entry)) return entry;\n    }\n    // No BYO key matched — fall through to include Builder as fallback.\n  }\n\n  for (const entry of _registry.values()) {\n    if (await hasAllKeys(entry)) return entry;\n  }\n  return null;\n}\n\n/**\n * Legacy inline API keys on the global `agent-engine` settings row are\n * intentionally ignored. That row is deployment-wide, so treating\n * `{ apiKey }` or `{ config: { apiKey } }` as configured would let one\n * user's pasted key power every other user. Per-user keys live in\n * `app_secrets` and are resolved separately.\n */\nexport function isAgentEngineSettingConfigured(stored: unknown): boolean {\n  if (!stored || typeof stored !== \"object\") return false;\n  const s = stored as {\n    engine?: unknown;\n  };\n  if (typeof s.engine !== \"string\" || !s.engine) return false;\n  return false;\n}\n\nfunction stripInlineApiKeyConfig(\n  config: Record<string, unknown> | undefined,\n): Record<string, unknown> {\n  if (!config) return {};\n  const { apiKey: _discardedApiKey, ...safeConfig } = config;\n  return safeConfig;\n}\n\n/**\n * True when the stored `agent-engine` row points at a registered engine\n * AND an API key for it is reachable via the engine's required env vars.\n * Inline keys on the global settings row are ignored; see\n * `isAgentEngineSettingConfigured`.\n */\nexport function isStoredEngineUsable(\n  stored: unknown,\n  entry: AgentEngineEntry,\n): boolean {\n  if (isAgentEngineSettingConfigured(stored)) return true;\n  if (entry.requiredEnvVars.length === 0) return true;\n  return entry.requiredEnvVars.every((v) => !!readDeployCredentialEnv(v));\n}\n\nexport interface ResolveEngineConfig {\n  /** Explicit engine name or instance from createAgentChatPlugin options */\n  engineOption?:\n    | string\n    | AgentEngine\n    | { name: string; config: Record<string, unknown> };\n  /** API key (used as config for the resolved engine) */\n  apiKey?: string;\n  /** Model override (used as part of engine config) */\n  model?: string;\n}\n\n/**\n * Resolve an AgentEngine from options → settings → env → default.\n *\n * Resolution order:\n * 1. Explicit `engineOption` from plugin options (string name, instance, or {name, config})\n * 2. Settings store key \"agent-engine\" → { engine: string }\n * 3. Env var AGENT_ENGINE\n * 4. Default \"anthropic\" (requires ANTHROPIC_API_KEY)\n */\nexport async function resolveEngine(\n  config: ResolveEngineConfig,\n): Promise<AgentEngine> {\n  const { engineOption, apiKey, model: _model } = config;\n\n  // 1. Explicit instance passed directly\n  if (\n    engineOption &&\n    typeof engineOption === \"object\" &&\n    \"stream\" in engineOption\n  ) {\n    return engineOption as AgentEngine;\n  }\n\n  // 2. Explicit {name, config} object\n  if (\n    engineOption &&\n    typeof engineOption === \"object\" &&\n    \"name\" in engineOption\n  ) {\n    const { name, config: engineConfig } = engineOption as {\n      name: string;\n      config: Record<string, unknown>;\n    };\n    const entry = _registry.get(name);\n    if (!entry)\n      throw new Error(\n        `[agent-engine] Unknown engine: \"${name}\". Registered: ${[..._registry.keys()].join(\", \")}`,\n      );\n    return entry.create({ apiKey, ...engineConfig });\n  }\n\n  // 3. Explicit string name from options\n  if (typeof engineOption === \"string\") {\n    const entry = _registry.get(engineOption);\n    if (!entry)\n      throw new Error(\n        `[agent-engine] Unknown engine: \"${engineOption}\". Registered: ${[..._registry.keys()].join(\", \")}`,\n      );\n    return entry.create({ apiKey });\n  }\n\n  // 4. Settings store — only when the stored row's API key is reachable.\n  try {\n    const stored = await getSetting(\"agent-engine\");\n    if (stored && typeof stored.engine === \"string\") {\n      const entry = _registry.get(stored.engine);\n      if (entry && isStoredEngineUsable(stored, entry)) {\n        return entry.create({\n          apiKey,\n          ...stripInlineApiKeyConfig(\n            stored.config as Record<string, unknown> | undefined,\n          ),\n        });\n      }\n    }\n  } catch {\n    // Settings not available — fall through\n  }\n\n  // 5. Env var — explicit engine name override\n  const envEngine = process.env.AGENT_ENGINE;\n  if (envEngine) {\n    const entry = _registry.get(envEngine);\n    if (entry) return entry.create({ apiKey });\n  }\n\n  // 6. Auto-detect from the current user's per-user `app_secrets` rows\n  // (Builder OAuth callback + \"paste your own key\" settings flow write\n  // here, not env). Comes before env-detection so a user-specific\n  // connection wins over a stale deploy-level key.\n  const detectedFromUser = await detectEngineFromUserSecrets();\n  if (detectedFromUser) return detectedFromUser.create({ apiKey });\n\n  // 8. Auto-detect from any provider env var — so just dropping a key in\n  // .env works without also setting AGENT_ENGINE.\n  const detected = detectEngineFromEnv();\n  if (detected) return detected.create({ apiKey });\n\n  // 9. Default: anthropic\n  const anthropicEntry = _registry.get(\"anthropic\");\n  if (!anthropicEntry) {\n    throw new Error(\n      \"[agent-engine] Default Anthropic engine is not registered. Did builtin.ts fail to load?\",\n    );\n  }\n  return anthropicEntry.create({ apiKey });\n}\n\n/**\n * Read the user-selected model for an engine from the `agent-engine` setting.\n *\n * The settings UI writes `{engine, model}` via the `manage-agent-engine` action=\"set\",\n * but `resolveEngine` only uses the stored engine (the model is a separate\n * per-request concern). Call this helper alongside `resolveEngine` to honor\n * the user's model choice without requiring a process restart.\n *\n * Returns the stored model only when the stored engine name matches `engine`\n * — otherwise returns `undefined` to avoid applying an Anthropic model string\n * to, say, an OpenRouter engine.\n */\nexport async function getStoredModelForEngine(\n  engine: AgentEngine | string,\n): Promise<string | undefined> {\n  const engineName = typeof engine === \"string\" ? engine : engine.name;\n  try {\n    const stored = await getSetting(\"agent-engine\");\n    if (\n      stored &&\n      typeof stored.engine === \"string\" &&\n      stored.engine === engineName &&\n      typeof stored.model === \"string\" &&\n      stored.model.length > 0\n    ) {\n      return stored.model;\n    }\n  } catch {\n    // Settings store not ready (fresh install, migration pending) — skip.\n  }\n  return undefined;\n}\n"]}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/agent/engine/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,aAAa,GACd,MAAM,qCAAqC,CAAC;AAuB7C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;AAEtD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAuB;IACzD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,+DAA+D;QAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACpC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CACV,0BAA0B,KAAK,CAAC,IAAI,oCAAoC,CACzE,CAAC;QACF,OAAO;IACT,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CACjC,IAAY;IAEZ,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAClC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAC9C,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YACvC,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACjD,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,oEAAoE;IACtE,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjD,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAClD,KAAK,GAAG,mBAAmB,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,UAAU,GAAG,KAAK,EAAE,KAAuB,EAAoB,EAAE;QACrE,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAClC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAC9C,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YACvC,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC5C,CAAC;QACD,oEAAoE;IACtE,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAe;IAC5D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,CAAC,GAAG,MAET,CAAC;IACF,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAA2C;IAE3C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;IAC3D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAe,EACf,KAAuB;IAEvB,IAAI,8BAA8B,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAe,EACf,KAAuB;IAEvB,IAAI,8BAA8B,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,IAAI,MAAM,aAAa,CAAC,GAAG,CAAC;gBAAE,SAAS;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;QACD,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAcD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAEvD,uCAAuC;IACvC,IACE,YAAY;QACZ,OAAO,YAAY,KAAK,QAAQ;QAChC,QAAQ,IAAI,YAAY,EACxB,CAAC;QACD,OAAO,YAA2B,CAAC;IACrC,CAAC;IAED,oCAAoC;IACpC,IACE,YAAY;QACZ,OAAO,YAAY,KAAK,QAAQ;QAChC,MAAM,IAAI,YAAY,EACtB,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,YAGtC,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,kBAAkB,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5F,CAAC;QACJ,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,uCAAuC;IACvC,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,KAAK,CACb,mCAAmC,YAAY,kBAAkB,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpG,CAAC;QACJ,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,6CAA6C;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC3C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,MAAM,GAEC,IAAI,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,CAAkB,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IAED,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,EAAE,CAAC;IAC7D,IAAI,gBAAgB,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,IAAI,CAAC,MAAM,8BAA8B,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC,MAAM,CAAC;gBAClB,MAAM;gBACN,GAAG,uBAAuB,CACxB,MAAM,CAAC,MAA6C,CACrD;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAEjE,uEAAuE;IACvE,gDAAgD;IAChD,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAEjD,wBAAwB;IACxB,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAA4B;IAE5B,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;QAChD,IACE,MAAM;YACN,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,MAAM,CAAC,MAAM,KAAK,UAAU;YAC5B,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EACvB,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * Agent Engine Registry.\n *\n * Mirrors the CLI_REGISTRY pattern (packages/core/src/terminal/cli-registry.ts)\n * but is open — anyone can register a custom engine via registerAgentEngine()\n * from a server plugin at startup.\n *\n * Built-in engines (anthropic, ai-sdk) are auto-registered by builtin.ts.\n */\n\nimport type {\n  AgentEngine,\n  EngineCapabilities,\n  EngineStreamOptions,\n} from \"./types.js\";\nimport { getSetting } from \"../../settings/store.js\";\nimport {\n  readDeployCredentialEnv,\n  resolveSecret,\n} from \"../../server/credential-provider.js\";\n\nexport interface AgentEngineEntry {\n  /** Unique name, e.g. \"anthropic\", \"ai-sdk:anthropic\", \"ai-sdk:openai\" */\n  name: string;\n  /** Human-readable label for UI */\n  label: string;\n  /** Short description for engine picker */\n  description: string;\n  /** npm package hint displayed in UI when package is missing */\n  installPackage?: string;\n  /** Engine capabilities */\n  capabilities: EngineCapabilities;\n  /** Default model string */\n  defaultModel: string;\n  /** All supported models (shown in model picker) */\n  supportedModels: readonly string[];\n  /** Environment variables required for this engine to work */\n  requiredEnvVars: string[];\n  /** Create an engine instance from config */\n  create(config: Record<string, unknown>): AgentEngine;\n}\n\nconst _registry = new Map<string, AgentEngineEntry>();\n\n/**\n * Register a custom agent engine. Called at server startup (e.g., from a\n * server plugin or builtin.ts). Throws if name is already registered.\n */\nexport function registerAgentEngine(entry: AgentEngineEntry): void {\n  if (_registry.has(entry.name)) {\n    // Allow re-registration in tests / hot-reload — just overwrite\n    if (process.env.NODE_ENV === \"test\") {\n      _registry.set(entry.name, entry);\n      return;\n    }\n    console.warn(\n      `[agent-engine] Engine \"${entry.name}\" is already registered. Skipping.`,\n    );\n    return;\n  }\n  _registry.set(entry.name, entry);\n}\n\n/** Get a registered engine entry by name, or undefined if not found */\nexport function getAgentEngineEntry(\n  name: string,\n): AgentEngineEntry | undefined {\n  return _registry.get(name);\n}\n\n/** List all registered engine entries */\nexport function listAgentEngines(): AgentEngineEntry[] {\n  return Array.from(_registry.values());\n}\n\n/**\n * First registered engine whose requiredEnvVars are all set. Registration\n * order controls priority — the Builder gateway is registered first so it\n * wins when the Builder private key is present.\n *\n * Escape hatch: AGENT_ENGINE_PREFER_BYO_KEY=true skips the Builder engine\n * on the first pass, so an explicit provider key (ANTHROPIC_API_KEY etc.)\n * is picked instead. Builder is still used as the fallback when no other\n * provider key is set.\n */\nexport function detectEngineFromEnv(): AgentEngineEntry | null {\n  const preferByo = /^(1|true)$/i.test(\n    process.env.AGENT_ENGINE_PREFER_BYO_KEY ?? \"\",\n  );\n\n  if (preferByo) {\n    for (const entry of _registry.values()) {\n      if (entry.name === \"builder\") continue;\n      if (entry.requiredEnvVars.length === 0) continue;\n      if (entry.requiredEnvVars.every((v) => !!readDeployCredentialEnv(v))) {\n        return entry;\n      }\n    }\n    // No BYO key matched — fall through to include Builder as fallback.\n  }\n\n  for (const entry of _registry.values()) {\n    if (entry.requiredEnvVars.length === 0) continue;\n    if (entry.requiredEnvVars.every((v) => !!readDeployCredentialEnv(v))) {\n      return entry;\n    }\n  }\n  return null;\n}\n\n/**\n * Detect a usable engine from the current request user's accessible\n * `app_secrets` rows. Mirrors `detectEngineFromEnv` but consults the\n * encrypted secret store instead of `process.env`, including org-scoped\n * credentials shared with the active organization.\n *\n * Required because the Builder OAuth callback (and the settings UI's\n * \"paste your own key\" flow) writes credentials to app_secrets, not env.\n * Without this check, a user who connected Builder would see status\n * \"configured\" but the next chat turn would fall through to the default\n * Anthropic engine and hit `missing_api_key` — exactly Brent's symptom\n * on the docs site (Loom 2026-04-28: \"It doesn't seem to realize I'm\n * connected once I do a chat\").\n *\n * Includes the local dev session (`local@localhost`): the Builder\n * OAuth flow writes credentials scoped to that email when run from\n * `pnpm dev`, so detection has to consult those rows or the dev user\n * sees the same \"Connect your AI\" card after they've already connected\n * (Sami, 2026-04-30). Org-scoped Builder credentials must also count here:\n * `/builder/status` resolves them via the same request org context, and the\n * chat engine picker must not disagree with that card.\n */\nexport async function detectEngineFromUserSecrets(): Promise<AgentEngineEntry | null> {\n  let email: string | undefined;\n  try {\n    const { getRequestUserEmail } =\n      await import(\"../../server/request-context.js\");\n    email = getRequestUserEmail();\n  } catch {\n    return null;\n  }\n  if (!email) return null;\n\n  const hasAllKeys = async (entry: AgentEngineEntry): Promise<boolean> => {\n    if (entry.requiredEnvVars.length === 0) return false;\n    for (const key of entry.requiredEnvVars) {\n      try {\n        if (!(await resolveSecret(key))) return false;\n      } catch {\n        return false;\n      }\n    }\n    return true;\n  };\n\n  const preferByo = /^(1|true)$/i.test(\n    process.env.AGENT_ENGINE_PREFER_BYO_KEY ?? \"\",\n  );\n\n  if (preferByo) {\n    for (const entry of _registry.values()) {\n      if (entry.name === \"builder\") continue;\n      if (await hasAllKeys(entry)) return entry;\n    }\n    // No BYO key matched — fall through to include Builder as fallback.\n  }\n\n  for (const entry of _registry.values()) {\n    if (await hasAllKeys(entry)) return entry;\n  }\n  return null;\n}\n\n/**\n * Legacy inline API keys on the global `agent-engine` settings row are\n * intentionally ignored. That row is deployment-wide, so treating\n * `{ apiKey }` or `{ config: { apiKey } }` as configured would let one\n * user's pasted key power every other user. Per-user keys live in\n * `app_secrets` and are resolved separately.\n */\nexport function isAgentEngineSettingConfigured(stored: unknown): boolean {\n  if (!stored || typeof stored !== \"object\") return false;\n  const s = stored as {\n    engine?: unknown;\n  };\n  if (typeof s.engine !== \"string\" || !s.engine) return false;\n  return false;\n}\n\nfunction stripInlineApiKeyConfig(\n  config: Record<string, unknown> | undefined,\n): Record<string, unknown> {\n  if (!config) return {};\n  const { apiKey: _discardedApiKey, ...safeConfig } = config;\n  return safeConfig;\n}\n\n/**\n * True when the stored `agent-engine` row points at a registered engine\n * AND an API key for it is reachable via the engine's required env vars.\n * Inline keys on the global settings row are ignored; see\n * `isAgentEngineSettingConfigured`.\n */\nexport function isStoredEngineUsable(\n  stored: unknown,\n  entry: AgentEngineEntry,\n): boolean {\n  if (isAgentEngineSettingConfigured(stored)) return true;\n  if (entry.requiredEnvVars.length === 0) return true;\n  return entry.requiredEnvVars.every((v) => !!readDeployCredentialEnv(v));\n}\n\n/**\n * Request-aware version of `isStoredEngineUsable`.\n *\n * The settings row stores the selected engine/model, while credentials may\n * live in per-user/org `app_secrets`. The sync helper intentionally only sees\n * deploy env vars; this async helper is what request-time routes should use\n * when deciding whether a stored engine can actually run for the current user.\n */\nexport async function isStoredEngineUsableForRequest(\n  stored: unknown,\n  entry: AgentEngineEntry,\n): Promise<boolean> {\n  if (isAgentEngineSettingConfigured(stored)) return true;\n  if (entry.requiredEnvVars.length === 0) return true;\n  for (const key of entry.requiredEnvVars) {\n    try {\n      if (await resolveSecret(key)) continue;\n    } catch {\n      // Fall through to the deployment-level check below.\n    }\n    if (!readDeployCredentialEnv(key)) return false;\n  }\n  return true;\n}\n\nexport interface ResolveEngineConfig {\n  /** Explicit engine name or instance from createAgentChatPlugin options */\n  engineOption?:\n    | string\n    | AgentEngine\n    | { name: string; config: Record<string, unknown> };\n  /** API key (used as config for the resolved engine) */\n  apiKey?: string;\n  /** Model override (used as part of engine config) */\n  model?: string;\n}\n\n/**\n * Resolve an AgentEngine from options → explicit env → request credentials →\n * settings → env → default.\n *\n * Resolution order:\n * 1. Explicit `engineOption` from plugin options (string name, instance, or {name, config})\n * 2. Env var AGENT_ENGINE\n * 3. Current request's app_secrets; Builder wins by default when connected\n * 4. Settings store key \"agent-engine\" → { engine: string }, when usable\n * 5. Auto-detect deployment env credentials\n * 6. Default \"anthropic\" (requires ANTHROPIC_API_KEY)\n */\nexport async function resolveEngine(\n  config: ResolveEngineConfig,\n): Promise<AgentEngine> {\n  const { engineOption, apiKey, model: _model } = config;\n\n  // 1. Explicit instance passed directly\n  if (\n    engineOption &&\n    typeof engineOption === \"object\" &&\n    \"stream\" in engineOption\n  ) {\n    return engineOption as AgentEngine;\n  }\n\n  // 2. Explicit {name, config} object\n  if (\n    engineOption &&\n    typeof engineOption === \"object\" &&\n    \"name\" in engineOption\n  ) {\n    const { name, config: engineConfig } = engineOption as {\n      name: string;\n      config: Record<string, unknown>;\n    };\n    const entry = _registry.get(name);\n    if (!entry)\n      throw new Error(\n        `[agent-engine] Unknown engine: \"${name}\". Registered: ${[..._registry.keys()].join(\", \")}`,\n      );\n    return entry.create({ apiKey, ...engineConfig });\n  }\n\n  // 3. Explicit string name from options\n  if (typeof engineOption === \"string\") {\n    const entry = _registry.get(engineOption);\n    if (!entry)\n      throw new Error(\n        `[agent-engine] Unknown engine: \"${engineOption}\". Registered: ${[..._registry.keys()].join(\", \")}`,\n      );\n    return entry.create({ apiKey });\n  }\n\n  // 4. Env var — explicit engine name override\n  const envEngine = process.env.AGENT_ENGINE;\n  if (envEngine) {\n    const entry = _registry.get(envEngine);\n    if (entry) return entry.create({ apiKey });\n  }\n\n  let stored:\n    | (Record<string, unknown> & { engine?: unknown; config?: unknown })\n    | null = null;\n  try {\n    stored = (await getSetting(\"agent-engine\")) as typeof stored;\n  } catch {\n    // Settings not available — fall through\n  }\n\n  // 5. Auto-detect from the current user's per-user `app_secrets` rows\n  // (Builder OAuth callback + \"paste your own key\" settings flow write\n  // here, not env). Comes before env-detection so a user-specific\n  // Builder connection wins over a stale deploy-level/provider key.\n  const detectedFromUser = await detectEngineFromUserSecrets();\n  if (detectedFromUser?.name === \"builder\") {\n    return detectedFromUser.create({ apiKey });\n  }\n\n  // 6. Settings store — only when the stored row's API key is reachable.\n  // This remains below Builder detection so \"Builder.io connected\" and the\n  // runtime agree on the default managed gateway path. Non-Builder user keys\n  // still honor the stored provider/model when Builder is not connected.\n  if (stored && typeof stored.engine === \"string\") {\n    const entry = _registry.get(stored.engine);\n    if (entry && (await isStoredEngineUsableForRequest(stored, entry))) {\n      return entry.create({\n        apiKey,\n        ...stripInlineApiKeyConfig(\n          stored.config as Record<string, unknown> | undefined,\n        ),\n      });\n    }\n  }\n\n  if (detectedFromUser) return detectedFromUser.create({ apiKey });\n\n  // 8. Auto-detect from any provider env var — so just dropping a key in\n  // .env works without also setting AGENT_ENGINE.\n  const detected = detectEngineFromEnv();\n  if (detected) return detected.create({ apiKey });\n\n  // 9. Default: anthropic\n  const anthropicEntry = _registry.get(\"anthropic\");\n  if (!anthropicEntry) {\n    throw new Error(\n      \"[agent-engine] Default Anthropic engine is not registered. Did builtin.ts fail to load?\",\n    );\n  }\n  return anthropicEntry.create({ apiKey });\n}\n\n/**\n * Read the user-selected model for an engine from the `agent-engine` setting.\n *\n * The settings UI writes `{engine, model}` via the `manage-agent-engine` action=\"set\",\n * but `resolveEngine` only uses the stored engine (the model is a separate\n * per-request concern). Call this helper alongside `resolveEngine` to honor\n * the user's model choice without requiring a process restart.\n *\n * Returns the stored model only when the stored engine name matches `engine`\n * — otherwise returns `undefined` to avoid applying an Anthropic model string\n * to, say, an OpenRouter engine.\n */\nexport async function getStoredModelForEngine(\n  engine: AgentEngine | string,\n): Promise<string | undefined> {\n  const engineName = typeof engine === \"string\" ? engine : engine.name;\n  try {\n    const stored = await getSetting(\"agent-engine\");\n    if (\n      stored &&\n      typeof stored.engine === \"string\" &&\n      stored.engine === engineName &&\n      typeof stored.model === \"string\" &&\n      stored.model.length > 0\n    ) {\n      return stored.model;\n    }\n  } catch {\n    // Settings store not ready (fresh install, migration pending) — skip.\n  }\n  return undefined;\n}\n"]}

package/dist/client/AgentPanel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AgentPanel.d.ts","sourceRoot":"","sources":["../../src/client/AgentPanel.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KASN,MAAM,OAAO,CAAC;AAwCf,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAwJ7D,MAAM,WAAW,oBAAoB;IACnC,mGAAmG;IACnG,OAAO,EAAE,OAAO,CAAC;IACjB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAC3C,kBAAkB,EAClB,eAAe,CAChB;IACC,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC7B,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6GAA6G;IAC7G,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;IACxB,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6HAA6H;IAC7H,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;IAChC,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC7B,yEAAyE;IACzE,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAyzCD,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,2CAShD;AAID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;yDACqD;IACrD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,sDAAsD;IACtD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oEAAoE;IACpE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,cAAsC,EACtC,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,QAAkB,EAClB,WAAmB,EACnB,aAAqB,GACtB,EAAE,iBAAiB,2CAqVnB;AAED;;;GAGG;AACH,wBAAgB,cAAc,SAgB7B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,SAAS,EAAE,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,2CAuBtE"}
+{"version":3,"file":"AgentPanel.d.ts","sourceRoot":"","sources":["../../src/client/AgentPanel.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KASN,MAAM,OAAO,CAAC;AAwCf,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AA6J7D,MAAM,WAAW,oBAAoB;IACnC,mGAAmG;IACnG,OAAO,EAAE,OAAO,CAAC;IACjB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAC3C,kBAAkB,EAClB,eAAe,CAChB;IACC,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC7B,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6GAA6G;IAC7G,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;IACxB,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6HAA6H;IAC7H,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;IAChC,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC7B,yEAAyE;IACzE,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AA2zCD,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,2CAShD;AAID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;yDACqD;IACrD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,sDAAsD;IACtD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oEAAoE;IACpE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,cAAsC,EACtC,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,QAAkB,EAClB,WAAmB,EACnB,aAAqB,GACtB,EAAE,iBAAiB,2CAqVnB;AAED;;;GAGG;AACH,wBAAgB,cAAc,SAgB7B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,SAAS,EAAE,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,2CAuBtE"}

package/dist/client/AgentPanel.js

@@ -35,13 +35,18 @@ import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { useLocation, useNavigate } from "react-router";
 import { cn } from "./utils.js";
 import { agentNativePath } from "./api-path.js";
-import { getFrameOrigin, isTrustedFrameMessage } from "./frame.js";
+import { getFrameOrigin, isInFrame, isTrustedFrameMessage } from "./frame.js";
 import { getInitialAgentSidebarOpen, SIDEBAR_OPEN_KEY, } from "./agent-sidebar-state.js";
 // Lazy-load AgentTerminal to avoid bundling xterm.js when not needed
 const AgentTerminal = lazy(() => import("./terminal/index.js").then((m) => ({ default: m.AgentTerminal })));
 function parentFrameTargetOrigin() {
     return getFrameOrigin() ?? window.location.origin;
 }
+function isAgentNativeDesktop() {
+    if (typeof navigator === "undefined")
+        return false;
+    return /AgentNativeDesktop/i.test(navigator.userAgent);
+}
 // Lazy-load ResourcesPanel to avoid bundling when not needed
 const ResourcesPanel = lazy(() => import("./resources/ResourcesPanel.js").then((m) => ({
     default: m.ResourcesPanel,
@@ -268,7 +273,8 @@ function AgentPanelInner({ defaultMode = "chat", className, apiUrl, emptyStateTe
     const [selectedCli, selectCli] = useCliSelection(keyPrefix);
     const selectedLabel = availableClis.find((c) => c.command === selectedCli)?.label || selectedCli;
     const { isDevMode, canToggle, setDevMode } = useDevMode(apiUrl);
-    const codeAccessEnabled = codeAccess?.enabled !== false;
+    const inferredCodeAccessEnabled = !isDevMode || isAgentNativeDesktop() || isInFrame();
+    const codeAccessEnabled = codeAccess?.enabled ?? inferredCodeAccessEnabled;
     const codeUnavailableTitle = codeAccess?.unavailableTitle ?? "Open Desktop to edit code";
     const codeUnavailableDescription = codeAccess?.unavailableDescription ??
         "Source-code changes, workspace files, and CLI access are available in the Agent Native Desktop app.";