@agent-native/core 0.122.4 → 0.123.0

package/corpus/core/src/credentials/index.ts

@@ -1,3 +1,4 @@
+import { getDbExec } from "../db/client.js";
 import {
   encryptSecretValue,
   decryptSecretValue,
@@ -89,8 +90,9 @@ export async function resolveCredentialForScope(
  *   3. org-scoped app_secrets
  *   4. legacy workspace-scoped app_secrets for the org
  *   5. org-scoped legacy settings credential
+ *   6. solo workspace-scoped app_secrets (`solo:<email>`)
  *
- * Without an active org, step 3 is replaced by the solo workspace scope.
+ * Steps 3-5 are skipped without an active org.
  */
 export async function resolveCredential(
   key: string,
@@ -118,12 +120,132 @@ export async function resolveCredential(
     );
     if (workspaceSecret) return workspaceSecret;
 
-    return resolveCredentialForScope(key, { ...ctx, scope: "org" });
+    const orgSetting = await resolveCredentialForScope(key, {
+      ...ctx,
+      scope: "org",
+    });
+    if (orgSetting) return orgSetting;
   }
 
+  // Solo-workspace fallback: always checked, even when an org id was found
+  // above. A credential written before the user joined/created an org lives
+  // here, and must not become unreachable once that org exists. Last on
+  // purpose — a current org-scoped value always wins over a pre-org one.
   return readScopedAppSecret(key, "workspace", `solo:${ctx.userEmail}`);
 }
 
+/**
+ * Explain an empty credential lookup when a key of that name is saved in a
+ * scope the caller cannot read.
+ *
+ * Two distinct causes produce the same "the key is right there and it still
+ * says it's missing" report:
+ *
+ *  - Non-interactive runs — integration/webhook deliveries, scheduled jobs,
+ *    automations, and inbound A2A calls — resolve credentials as an owner
+ *    identity rather than as the person who triggered them, so a teammate's
+ *    Personal key is invisible to them even though the vault visibly holds it.
+ *  - The key is saved in a DIFFERENT organization the caller also belongs to.
+ *    Credentials are per-organization, so gaining a second organization (or
+ *    having `active-org-id` repointed at one) orphans every key synced under
+ *    the first. Without this, the only symptom is a missing-env-var error that
+ *    names the key rather than the org mismatch that actually caused it.
+ *
+ * SECURITY: both probes are bounded to organizations the caller is a member
+ * of, report only the scope kind (and, for the cross-org case, the name of an
+ * org the caller already belongs to), and never return the owning account, how
+ * many rows matched, or any part of the value. Without an active org there is
+ * no boundary to bound the probe to, so it declines to answer rather than
+ * revealing that some other tenant holds a key of the same name.
+ *
+ * Returns null when nothing safe and useful can be said.
+ */
+export async function describeCredentialScopeGap(
+  keys: readonly string[],
+  ctx: CredentialContext,
+): Promise<string | null> {
+  if (!ctx?.userEmail || !ctx.orgId) return null;
+
+  for (const key of keys) {
+    if (await hasForeignPersonalCredentialInOrg(key, ctx)) {
+      return (
+        `A "${key}" key is saved in this workspace with Personal scope. ` +
+        `Personal keys are readable only by their own owner's signed-in sessions, ` +
+        `and this run resolves credentials as the owner identity behind the ` +
+        `integration, job, or automation — so it needs "${key}" saved with ` +
+        `Workspace or Organization scope instead.`
+      );
+    }
+
+    const holder = await findMemberOrgHoldingCredential(key, ctx);
+    if (holder) {
+      return (
+        `A "${key}" key is saved in the ${holder} organization, but this ` +
+        `request resolved to a different organization you also belong to. ` +
+        `Credentials are scoped per organization and are not shared between ` +
+        `them, so this is an organization mismatch rather than a missing key. ` +
+        `Either switch your active organization back to ${holder}, or save ` +
+        `"${key}" in the organization this request runs in.`
+      );
+    }
+  }
+  return null;
+}
+
+async function hasForeignPersonalCredentialInOrg(
+  key: string,
+  ctx: CredentialContext,
+): Promise<boolean> {
+  try {
+    const { rows } = await getDbExec().execute({
+      sql: `SELECT 1 FROM app_secrets s
+              JOIN org_members m ON LOWER(m.email) = LOWER(s.scope_id)
+             WHERE s.key = ? AND s.scope = 'user'
+               AND m.org_id = ? AND LOWER(s.scope_id) <> ?
+             LIMIT 1`,
+      args: [key, ctx.orgId!, ctx.userEmail.toLowerCase()],
+    });
+    return rows.length > 0;
+  } catch {
+    // Missing app_secrets/org_members table, or any other read failure — a
+    // diagnostic must never replace the real "not configured" error.
+    return false;
+  }
+}
+
+/**
+ * Name an organization the caller is a member of that holds this key, other
+ * than the one the request resolved to. Returns a quoted display name, or the
+ * bare word `another` when the org row is unreadable — never an org id, which
+ * would be useless to the person reading the error.
+ */
+async function findMemberOrgHoldingCredential(
+  key: string,
+  ctx: CredentialContext,
+): Promise<string | null> {
+  try {
+    const { rows } = await getDbExec().execute({
+      sql: `SELECT o.name AS org_name
+              FROM app_secrets s
+              JOIN org_members m ON m.org_id = s.scope_id
+                                AND LOWER(m.email) = ?
+              LEFT JOIN organizations o ON o.id = s.scope_id
+             WHERE s.key = ?
+               AND s.scope IN ('org', 'workspace')
+               AND s.scope_id <> ?
+             LIMIT 1`,
+      args: [ctx.userEmail.toLowerCase(), key, ctx.orgId!],
+    });
+    if (rows.length === 0) return null;
+    const name = (rows[0] as { org_name?: unknown }).org_name;
+    return typeof name === "string" && name.trim()
+      ? `"${name.trim()}"`
+      : "another";
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Check if a credential is available for the given context.
  */

package/corpus/core/src/deploy/build.ts

@@ -22,12 +22,14 @@ import { fileURLToPath } from "url";
 
 import {
   AGENT_BACKGROUND_FUNCTION_NAME,
+  AGENT_BACKGROUND_FUNCTION_URL_PATH,
   AGENT_BACKGROUND_PROCESSOR_A2A,
   AGENT_BACKGROUND_PROCESSOR_FIELD,
   AGENT_BACKGROUND_PROCESSOR_INTEGRATION,
   AGENT_BACKGROUND_PROCESSOR_ROUTE,
   AGENT_BACKGROUND_PROCESSOR_ROUTE_FIELD,
   AGENT_CHAT_PROCESS_RUN_PATH,
+  isDurableBackgroundFlagEnabled,
 } from "../agent/durable-background.js";
 import {
   INTEGRATION_RETRY_SWEEP_PATH,
@@ -2356,8 +2358,9 @@ export function findInstalledResvgPackages(
  * Reads the same env flag the runtime gate uses
  * (`AGENT_CHAT_DURABLE_BACKGROUND`).
  *
- * DEFAULT-OFF (opt-in), matching the runtime gate (`isFlagEnabled` in
- * durable-background.ts): unset/empty/unknown means DISABLED; an app opts IN
+ * DEFAULT-OFF (opt-in). It IS the runtime gate's flag parse
+ * (`isDurableBackgroundFlagEnabled`), so the two can no longer drift:
+ * unset/empty/unknown means DISABLED; an app opts IN
  * only with an explicit truthy value (`true`/`1`/`yes`/`on`). A premature
  * fleet-wide default-on caused real-user incidents (2026-06-24) before the
  * async worker path was proven, so durable is opt-in until verified live. This
@@ -2368,13 +2371,24 @@ export function findInstalledResvgPackages(
  * the worker into the ~13-min timeout regime, the worker would overshoot the
  * ~60s synchronous wall and re-dispatch in a loop. (The runtime now also guards
  * the ~13-min budget on the real function name via `isInBackgroundFunctionRuntime`,
- * so a missing emit degrades to clean 40s-chunked runs rather than the loop.)
+ * so a missing emit does not loop.) A missing emit is NOT benign, though: the
+ * app then runs every turn on the ~60s synchronous wall for the life of the
+ * deploy, so an opted-in build that cannot emit the function FAILS rather than
+ * warning.
  */
 export function isDurableBackgroundDeployEnabled(): boolean {
-  const raw = process.env.AGENT_CHAT_DURABLE_BACKGROUND;
-  if (raw == null) return false;
-  const v = raw.trim().toLowerCase();
-  return v === "1" || v === "true" || v === "yes" || v === "on";
+  return isDurableBackgroundFlagEnabled();
+}
+
+/**
+ * True when this build MUST ship the `-background` function: either the chat
+ * opt-in or the integration durable dispatch depends on it at runtime.
+ */
+function isDurableBackgroundEmitRequired(): boolean {
+  return (
+    isDurableBackgroundDeployEnabled() ||
+    isIntegrationDurableDispatchDeployEnabled()
+  );
 }
 
 export const NETLIFY_INTEGRATION_RECOVERY_FUNCTION_NAME =
@@ -2409,7 +2423,16 @@ export function emitSingleTemplateNetlifyKeepWarmFunction(
   fs.rmSync(dest, { recursive: true, force: true });
   fs.mkdirSync(dest, { recursive: true });
 
+  // The background Lambda is a SEPARATE container from `server`: warming the
+  // health route never touches it, so it cold-started on essentially every
+  // dispatch (18.4s observed to reach the agent loop). A POST with no runId is
+  // rejected by the `_process-run` route before any DB work, so this only keeps
+  // the container alive.
+  const backgroundWarmPath = isDurableBackgroundEmitRequired()
+    ? JSON.stringify(AGENT_BACKGROUND_FUNCTION_URL_PATH)
+    : "null";
   const entry = `const HEALTH_PATH = "/_agent-native/health";
+const BACKGROUND_WARM_PATH = ${backgroundWarmPath};
 const REQUEST_TIMEOUT_MS = 25_000;
 
 function siteOrigin(request) {
@@ -2418,8 +2441,31 @@ function siteOrigin(request) {
   return new URL(request.url).origin;
 }
 
+async function warmBackgroundFunction(origin) {
+  if (!BACKGROUND_WARM_PATH) return;
+  const url = new URL(BACKGROUND_WARM_PATH, origin);
+  try {
+    // Best-effort: an unwarmed background function is a latency problem, not a
+    // reason to fail the scheduled run that also warms the server + database.
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "user-agent": "agent-native-netlify-keep-warm",
+      },
+      body: "{}",
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    console.log("[agent-native-keep-warm] Warmed", url.toString(), response.status);
+  } catch (error) {
+    console.warn("[agent-native-keep-warm] Background warm failed:", url.toString(), error);
+  }
+}
+
 export default async function handler(request) {
-  const url = new URL(HEALTH_PATH, siteOrigin(request));
+  const origin = siteOrigin(request);
+  const backgroundWarm = warmBackgroundFunction(origin);
+  const url = new URL(HEALTH_PATH, origin);
   let response;
   try {
     response = await fetch(url, {
@@ -2441,6 +2487,7 @@ export default async function handler(request) {
     );
   }
 
+  await backgroundWarm;
   console.log("[agent-native-keep-warm] Warmed", url.toString());
   return new Response(null, { status: 204 });
 }
@@ -2530,12 +2577,15 @@ export function emitSingleTemplateNetlifyBackgroundFunction(
   const internalDir = path.join(projectCwd, ".netlify", "functions-internal");
   const serverDir = path.join(internalDir, "server");
   if (!fs.existsSync(path.join(serverDir, "main.mjs"))) {
-    // Nitro output layout differs from what we expected — skip rather than
-    // guess. The single-function deploy is unaffected.
-    console.warn(
-      "[build] Durable-background emit skipped: expected Nitro Netlify function " +
-        "at .netlify/functions-internal/server/main.mjs was not found.",
-    );
+    // Nitro output layout differs from what we expected — cannot guess.
+    const message =
+      "Durable-background emit skipped: expected Nitro Netlify function " +
+      "at .netlify/functions-internal/server/main.mjs was not found.";
+    // Shipping without the function when the runtime depends on it is worse
+    // than a red build: the deploy silently loses the 15-min budget forever.
+    if (isDurableBackgroundEmitRequired())
+      throw new Error(`[build] ${message}`);
+    console.warn(`[build] ${message}`);
     return;
   }
   const backgroundName = AGENT_BACKGROUND_FUNCTION_NAME;
@@ -2677,6 +2727,7 @@ export const config = {
 };
 `;
   fs.writeFileSync(path.join(dest, `${backgroundName}.mjs`), entry);
+  assertEmittedBackgroundFunctionOnDisk(dest, backgroundName);
   console.log(
     `[build] Emitted durable-background function "${backgroundName}" into the ` +
       `scanned dir .netlify/functions-internal with config { background:true } ` +
@@ -2688,6 +2739,28 @@ export const config = {
   );
 }
 
+/**
+ * Prove the artifact Netlify will scan actually landed. A partial copy (the
+ * entry without its handler bundle) deploys as a function that 500s on every
+ * invocation, which looks exactly like "no background function" at runtime.
+ * Exported so the workspace deploy asserts the same shape.
+ */
+export function assertEmittedBackgroundFunctionOnDisk(
+  destDir: string,
+  functionName: string,
+): void {
+  const missing = [`${functionName}.mjs`, "main.mjs"].filter(
+    (file) => !fs.existsSync(path.join(destDir, file)),
+  );
+  if (missing.length === 0) return;
+  throw new Error(
+    `[build] Durable-background function "${functionName}" was not fully emitted — ` +
+      `missing ${missing.join(", ")} in ${destDir}. Netlify would deploy without ` +
+      "the 15-min background function and every agent turn would silently run on " +
+      "the synchronous function wall.",
+  );
+}
+
 export function emitSingleTemplateNetlifyIntegrationRecoveryFunction(
   projectCwd: string,
 ): void {
@@ -3052,10 +3125,7 @@ export function assertSingleTemplateNetlifyBuildOutput(
     );
   }
 
-  if (
-    isDurableBackgroundDeployEnabled() ||
-    isIntegrationDurableDispatchDeployEnabled()
-  ) {
+  if (isDurableBackgroundEmitRequired()) {
     const backgroundDir = path.join(
       internalDir,
       AGENT_BACKGROUND_FUNCTION_NAME,
@@ -3772,18 +3842,11 @@ export default bundle;
     // bundle, so the chat `_process-run` POST lands on Netlify's async (15-min)
     // function. When not opted in this is a no-op and the single-function
     // deploy is byte-for-byte unchanged.
-    if (
-      isDurableBackgroundDeployEnabled() ||
-      isIntegrationDurableDispatchDeployEnabled()
-    ) {
-      try {
-        emitSingleTemplateNetlifyBackgroundFunction(cwd);
-      } catch (err) {
-        console.warn(
-          "[build] Failed to emit durable-background Netlify function (non-fatal):",
-          err instanceof Error ? err.message : err,
-        );
-      }
+    // NOT wrapped in try/catch: this block only runs when the runtime depends
+    // on the function, and a swallowed failure ships an app that loses the
+    // background budget for the life of the deploy with nothing in the log.
+    if (isDurableBackgroundEmitRequired()) {
+      emitSingleTemplateNetlifyBackgroundFunction(cwd);
     }
 
     if (isIntegrationDurableDispatchDeployEnabled()) {

package/corpus/core/src/deploy/workspace-deploy.ts

@@ -25,6 +25,7 @@ import {
   AGENT_BACKGROUND_PROCESSOR_ROUTE,
   AGENT_BACKGROUND_PROCESSOR_ROUTE_FIELD,
   AGENT_CHAT_PROCESS_RUN_PATH,
+  isDurableBackgroundFlagExplicitlyDisabled,
 } from "../agent/durable-background.js";
 import {
   INTEGRATION_RETRY_SWEEP_PATH,
@@ -42,6 +43,7 @@ import {
   type WorkspaceAppAudience,
 } from "../shared/workspace-app-audience.js";
 import { DISPATCH_WORKSPACE_ROOT_REDIRECTS } from "../shared/workspace-app-id.js";
+import { assertEmittedBackgroundFunctionOnDisk } from "./build.js";
 import {
   collectImmutableAssetPaths,
   IMMUTABLE_ASSET_CACHE_HEADERS,
@@ -680,12 +682,14 @@ function copyNetlifyFunctionIntoWorkspace(
   copyDir(src, dest);
   patchNetlifyFunctionEntry(dest, app, workspaceApps, staticDir);
 
-  // Durable background agent runs (default-ON; opt out with a falsy
-  // AGENT_CHAT_DURABLE_BACKGROUND). Additive ONLY: when explicitly opted out
+  // Durable background agent runs. Additive ONLY: when explicitly opted out
   // this emits nothing and the single-function deploy is unchanged.
   const integrationDurableDispatch =
     app === "dispatch" && isIntegrationDurableDispatchConfigured();
-  if (isDurableBackgroundDeployEnabled() || integrationDurableDispatch) {
+  if (
+    isDurableBackgroundWorkspaceDeployEnabled() ||
+    integrationDurableDispatch
+  ) {
     emitNetlifyBackgroundFunction(workspaceRoot, app, src, workspaceApps);
   }
   if (integrationDurableDispatch) {
@@ -699,21 +703,21 @@ function copyNetlifyFunctionIntoWorkspace(
 }
 
 /**
- * Deploy-time gate for emitting the second `-background` Netlify function. Reads
- * the same env flag the runtime gate uses (`AGENT_CHAT_DURABLE_BACKGROUND`).
+ * Deploy-time gate for emitting the per-app `-background` Netlify function.
  *
- * DEFAULT-ON, matching the runtime gate (`isFlagEnabled` in
- * durable-background.ts) and the single-template gate
- * (`isDurableBackgroundDeployEnabled` in deploy/build.ts): unset/empty/unknown
- * means enabled; an app opts OUT only with an explicit falsy value
- * (`false`/`0`/`no`/`off`). This emits the per-app 15-min `-background` function
- * so the chat `_process-run` dispatch lands on it with the real long budget.
+ * DELIBERATELY WIDER THAN THE SINGLE-TEMPLATE GATE, and it must stay exactly as
+ * wide as the WORKSPACE half of the runtime gate: a workspace app opts in
+ * through its agent-chat plugin (`durableBackgroundRuns`), which
+ * `isAgentChatDurableBackgroundEnabled({ appOptIn: true })` honors unless the
+ * env flag is EXPLICITLY falsy. So the emit condition is "not explicitly
+ * disabled" — narrowing it to the env-only opt-in would leave plugin-opted-in
+ * apps dispatching at a function that was never deployed. The predicates come
+ * from durable-background.ts so the deploy and runtime parses cannot drift
+ * (they had: this file's former local copy claimed to match a default-off gate
+ * while implementing a default-on one).
  */
-function isDurableBackgroundDeployEnabled(): boolean {
-  const raw = process.env.AGENT_CHAT_DURABLE_BACKGROUND;
-  if (raw == null) return true;
-  const v = raw.trim().toLowerCase();
-  return !(v === "0" || v === "false" || v === "no" || v === "off");
+export function isDurableBackgroundWorkspaceDeployEnabled(): boolean {
+  return !isDurableBackgroundFlagExplicitlyDisabled();
 }
 
 /**
@@ -878,6 +882,7 @@ export const config = {
   // is the function entrypoint, mirroring patchNetlifyFunctionEntry.
   fs.rmSync(path.join(dest, "server.mjs"), { force: true });
   fs.writeFileSync(path.join(dest, `${backgroundName}.mjs`), server);
+  assertEmittedBackgroundFunctionOnDisk(dest, backgroundName);
   console.log(
     `[workspace-deploy] Emitted durable-background function "${backgroundName}" ` +
       `for app "${app}" with config { background:true } and NO custom path — ` +

package/corpus/core/src/guards/no-localhost-fallback.ts

@@ -17,6 +17,13 @@
  * of hardcoded. The generic allowlist predicates (`*.spec.*`, `*.test.*`,
  * `scripts/**`, `**\/seed(s)/**`) are kept verbatim.
  *
+ * Also refuses to let request-handling code answer "who is the caller" with the
+ * ambient process identity (`?? process.env.AGENT_USER_EMAIL`,
+ * `|| process.env.WORKSPACE_OWNER_EMAIL`, `?? getAmbientUserEmail()`). That
+ * shape fails open toward more privilege: an admin gate reading it admits
+ * whoever the deploy env names rather than whoever signed in. CLI, cron, seed
+ * and test paths are exempt because they have no request by construction.
+ *
  * Opt-out (same line, or the line immediately above):
  *   const x = email ?? "local@localhost" // guard:allow-localhost-fallback — short reason
  */
@@ -52,6 +59,35 @@ const LITERAL_RE = /(?:"local@localhost"|'local@localhost'|`local@localhost`)/g;
 
 const SYMBOLIC_FALLBACK_RE = /(?:\?\?|\|\|)\s*DEV_MODE_USER_EMAIL\b/g;
 
+/**
+ * Ambient process identity used as a request-scoped fallback:
+ *
+ *   const email = getRequestUserEmail() ?? process.env.AGENT_USER_EMAIL;
+ *   const owner = session?.email || process.env.WORKSPACE_OWNER_EMAIL;
+ *
+ * These name the identity of the deployment, not the caller, so a request
+ * handler reading one authorizes whoever the env names — failing open toward
+ * more privilege. Only the `??` / `||` fallback position matches: reading the
+ * same env var to build an admin allowlist asks a different, safe question.
+ */
+const AMBIENT_ENV_FALLBACK_RE =
+  /(?:\?\?|\|\|)\s*process\.env\.(?:AGENT_USER_EMAIL|AGENT_ORG_ID|AGENT_USER_NAME|WORKSPACE_OWNER_EMAIL)\b/g;
+const AMBIENT_HELPER_FALLBACK_RE =
+  /(?:\?\?|\|\|)\s*getAmbient(?:UserEmail|OrgId)\s*\(\s*\)/g;
+
+/** Paths where an ambient identity is correct because no request exists by
+ * construction: CLI entrypoints, cron, seed and QA scripts, tests. */
+const AMBIENT_ALLOWED_PATH_PREDICATES: Array<(rel: string) => boolean> = [
+  (rel) => /(?:^|\/)scripts\//.test(rel),
+  (rel) => /(?:^|\/)src\/cli\//.test(rel),
+  (rel) => /(?:^|\/)src\/scripts\//.test(rel),
+  (rel) => /(?:^|\/)script-(?:helpers|entries)\.ts$/.test(rel),
+  (rel) => /\.spec\.[tj]sx?$/.test(rel),
+  (rel) => /\.test\.[tj]sx?$/.test(rel),
+  (rel) => /\/seed\//.test(rel),
+  (rel) => /\/seeds\//.test(rel),
+];
+
 const SQL_DEFAULT_RE = /\bDEFAULT\s+['"`]local@localhost['"`]/i;
 const DRIZZLE_DEFAULT_RE = /\.default\s*\(\s*['"`]local@localhost['"`]\s*\)/;
 
@@ -82,40 +118,66 @@ export function scanLocalhostFallback(
     if (!/\.(ts|tsx|mts|cts|js|mjs|cjs)$/.test(file)) continue;
     if (file.endsWith(".d.ts")) continue;
     const rel = relPosix(root, file);
-    if (isAllowedPath(rel, extraExemptPaths)) continue;
+    const literalAllowed = isAllowedPath(rel, extraExemptPaths);
+    const ambientAllowed = AMBIENT_ALLOWED_PATH_PREDICATES.some((p) => p(rel));
+    if (literalAllowed && ambientAllowed) continue;
 
     const contents = readFileSafe(file);
-    if (contents === null || !contents.includes("local@localhost")) continue;
+    if (contents === null) continue;
 
     const lines = contents.split("\n");
 
-    LITERAL_RE.lastIndex = 0;
-    let m: RegExpExecArray | null;
-    while ((m = LITERAL_RE.exec(contents)) !== null) {
-      const { line } = lineColForOffset(contents, m.index);
+    if (!ambientAllowed) {
+      for (const re of [AMBIENT_ENV_FALLBACK_RE, AMBIENT_HELPER_FALLBACK_RE]) {
+        re.lastIndex = 0;
+        let a: RegExpExecArray | null;
+        while ((a = re.exec(contents)) !== null) {
+          const { line } = lineColForOffset(contents, a.index);
+          const lineText = lines[line - 1] ?? "";
+          if (isCommentLine(lineText)) continue;
+          if (hasValidOptOut(lines, line - 1)) continue;
+          findings.push({
+            file: rel,
+            line,
+            message: `Ambient process identity used as a request-scoped fallback: ${lineText.trim()}. This authorizes whoever the deploy env names, not the signed-in user — fail closed on a missing caller, or call getAmbientUserEmail() from a CLI/cron path.`,
+          });
+        }
+      }
+    }
+
+    if (literalAllowed) continue;
+
+    // Scanned before the literal bail-out below: aliasing is exactly how this
+    // shape hides in a file that never spells out the literal itself.
+    SYMBOLIC_FALLBACK_RE.lastIndex = 0;
+    let symbolicMatch: RegExpExecArray | null;
+    while ((symbolicMatch = SYMBOLIC_FALLBACK_RE.exec(contents)) !== null) {
+      const { line } = lineColForOffset(contents, symbolicMatch.index);
       const lineText = lines[line - 1] ?? "";
       if (isCommentLine(lineText)) continue;
-      if (SQL_DEFAULT_RE.test(lineText)) continue;
-      if (DRIZZLE_DEFAULT_RE.test(lineText)) continue;
       if (hasValidOptOut(lines, line - 1)) continue;
       findings.push({
         file: rel,
         line,
-        message: `"local@localhost" used as a fallback identity: ${lineText.trim()}. Throw/401 on missing session instead — this pools every unauthenticated request onto one shared tenant.`,
+        message: `DEV_MODE_USER_EMAIL used as a fallback identity: ${lineText.trim()}. Throw/401 on missing session instead.`,
       });
     }
 
-    SYMBOLIC_FALLBACK_RE.lastIndex = 0;
-    let s: RegExpExecArray | null;
-    while ((s = SYMBOLIC_FALLBACK_RE.exec(contents)) !== null) {
-      const { line } = lineColForOffset(contents, s.index);
+    if (!contents.includes("local@localhost")) continue;
+
+    LITERAL_RE.lastIndex = 0;
+    let literalMatch: RegExpExecArray | null;
+    while ((literalMatch = LITERAL_RE.exec(contents)) !== null) {
+      const { line } = lineColForOffset(contents, literalMatch.index);
       const lineText = lines[line - 1] ?? "";
       if (isCommentLine(lineText)) continue;
+      if (SQL_DEFAULT_RE.test(lineText)) continue;
+      if (DRIZZLE_DEFAULT_RE.test(lineText)) continue;
       if (hasValidOptOut(lines, line - 1)) continue;
       findings.push({
         file: rel,
         line,
-        message: `DEV_MODE_USER_EMAIL used as a fallback identity: ${lineText.trim()}. Throw/401 on missing session instead.`,
+        message: `"local@localhost" used as a fallback identity: ${lineText.trim()}. Throw/401 on missing session instead — this pools every unauthenticated request onto one shared tenant.`,
       });
     }
   }

package/corpus/core/src/integrations/google-docs-poller.ts

@@ -1,11 +1,11 @@
 import { createAnthropicEngine } from "../agent/engine/index.js";
 import type { EngineMessage } from "../agent/engine/types.js";
 import {
-  runAgentLoop,
   actionsToEngineTools,
   filterInitialEngineTools,
   type ActionEntry,
 } from "../agent/production-agent.js";
+import { runAgentLoopDirectWithSoftTimeout } from "../agent/run-loop-with-resume.js";
 import { startRun, type ActiveRun } from "../agent/run-manager.js";
 import {
   buildAssistantMessage,
@@ -498,17 +498,24 @@ async function processComment(
       await runWithRequestContext(
         { userEmail: options.ownerEmail, orgId, isIntegrationCaller: true },
         () =>
-          runAgentLoop({
-            engine,
-            model: options.model,
-            systemPrompt: options.systemPrompt,
-            tools,
-            availableTools,
-            messages,
-            actions: runnableActions,
-            send,
-            signal,
-          }),
+          // Wrapper, not raw `runAgentLoop`: a doc-comment reply has no client
+          // driving continuation, so a transport-level cut has to be resumed
+          // inside this invocation or the commenter never gets an answer.
+          runAgentLoopDirectWithSoftTimeout(
+            {
+              engine,
+              model: options.model,
+              systemPrompt: options.systemPrompt,
+              tools,
+              availableTools,
+              messages,
+              actions: runnableActions,
+              send,
+              signal,
+            },
+            undefined,
+            { useHostedDefault: true },
+          ),
       );
     },
     async (completedRun: ActiveRun) => {