@agent-native/core 0.124.3 → 0.124.4

package/corpus/core/src/deploy/nitro-preset.ts

@@ -0,0 +1,50 @@
+import fs from "fs";
+import path from "path";
+
+export const AGENT_NATIVE_NITRO_PRESET_MARKER = path.join(
+  ".agent-native",
+  "nitro-preset",
+);
+
+function markerPath(cwd: string): string {
+  return path.join(cwd, AGENT_NATIVE_NITRO_PRESET_MARKER);
+}
+
+export function clearAgentNativeNitroPresetMarker(cwd = process.cwd()): void {
+  fs.rmSync(markerPath(cwd), { force: true });
+}
+
+export function writeAgentNativeNitroPresetMarker(
+  preset: string,
+  cwd = process.cwd(),
+): void {
+  const normalizedPreset = preset.trim();
+  if (!normalizedPreset) return;
+
+  const filePath = markerPath(cwd);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${normalizedPreset}\n`);
+}
+
+export function resolveAgentNativeNitroPreset({
+  cwd = process.cwd(),
+  env = process.env,
+}: {
+  cwd?: string;
+  env?: NodeJS.ProcessEnv;
+} = {}): string | undefined {
+  const environmentPreset = env.NITRO_PRESET?.trim();
+  if (environmentPreset) return environmentPreset;
+
+  const filePath = markerPath(cwd);
+  try {
+    const marker = fs.readFileSync(filePath, "utf8").trim();
+    if (!marker) {
+      throw new Error(`Agent-Native Nitro preset marker is empty: ${filePath}`);
+    }
+    return marker;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw error;
+  }
+}

package/corpus/core/src/integrations/pending-tasks-retry-job.ts

@@ -323,7 +323,8 @@ function getProcessingStuckAfterMs(): number {
     process.env.NETLIFY ||
     process.env.AWS_LAMBDA_FUNCTION_NAME ||
     process.env.VERCEL ||
-    "__cf_env" in globalThis
+    "__cf_env" in globalThis ||
+    "__env__" in globalThis
   ) {
     return SERVERLESS_PROCESSING_STUCK_AFTER_MS;
   }

package/corpus/core/src/scripts/call-agent.ts

@@ -77,12 +77,14 @@ function parseTimeoutMs(value: string | undefined): number | undefined {
 function isServerlessHost(): boolean {
   // Detection mirrors db/migrations.ts:297-301. On Cloudflare Workers/Pages,
   // `process.env` is shimmed and CF_PAGES isn't reliably populated at runtime —
-  // the canonical signal is the `__cf_env` global injected by workerd.
+  // the canonical signal is the `__cf_env`/`__env__` global injected by the
+  // Cloudflare runtime adapter.
   return (
     !!process.env.NETLIFY ||
     !!process.env.AWS_LAMBDA_FUNCTION_NAME ||
     !!process.env.VERCEL ||
-    "__cf_env" in globalThis
+    "__cf_env" in globalThis ||
+    "__env__" in globalThis
   );
 }
 

package/corpus/core/src/server/agent-discovery.ts

@@ -455,6 +455,7 @@ function isHostedRuntime(): boolean {
     !!process.env.AWS_LAMBDA_FUNCTION_NAME ||
     !!process.env.VERCEL ||
     "__cf_env" in globalThis ||
+    "__env__" in globalThis ||
     hasPublicRuntimeUrl()
   );
 }

package/corpus/core/src/server/agent-run-context.ts

@@ -34,6 +34,13 @@ function eventContext(
   return event.context;
 }
 
+function requestWaitUntil(
+  event: H3Event,
+): ((promise: Promise<unknown>) => void) | undefined {
+  const waitUntil = event.req?.waitUntil;
+  return typeof waitUntil === "function" ? waitUntil : undefined;
+}
+
 function normalizeId(value: string | null | undefined): string | undefined {
   return typeof value === "string" && value.trim().length > 0
     ? value.trim()
@@ -179,14 +186,17 @@ export async function resolveAgentRunRequestContext(options: {
 }): Promise<RequestContext> {
   const orgId = await resolveAgentRunOrgId(options);
   const timezone = readAgentRunTimezone(options.event);
+  const waitUntil = requestWaitUntil(options.event);
+  const run = {
+    ...(options.isBackgroundWorker ? { isBackgroundWorker: true } : {}),
+    ...(waitUntil ? { waitUntil } : {}),
+  };
   return {
     userEmail: options.ownerContext.owner,
     userName: options.ownerContext.name,
     orgId,
     timezone,
-    ...(options.isBackgroundWorker
-      ? { run: { isBackgroundWorker: true } }
-      : {}),
+    ...(Object.keys(run).length > 0 ? { run } : {}),
   };
 }
 

package/corpus/core/src/server/request-context.ts

@@ -84,6 +84,8 @@ function processEnv(name: string): string | undefined {
  * the live per-request value via `getRequestRunContext()`.
  */
 export interface RequestRunContext {
+  /** Request-scoped serverless continuation hook, when the runtime provides one. */
+  waitUntil?: (promise: Promise<unknown>) => void;
   /** Origin of the current request (used by the builder-browser tool). */
   requestOrigin?: string;
   /** Stable browser tab id for tab-scoped app-state reads/writes. */

package/corpus/core/src/shared/cloudflare-globals.d.ts

@@ -31,4 +31,5 @@ interface CfEnv {
 }
 
 declare var __cf_env: CfEnv | undefined;
-declare var __cf_ctx: { waitUntil(p: Promise<unknown>): void } | undefined;
+/** Nitro's native Cloudflare preset exposes the request environment here. */
+declare var __env__: CfEnv | undefined;

package/corpus/core/src/shared/runtime.ts

@@ -12,6 +12,7 @@ export function isNodeRuntime(): boolean {
     typeof process !== "undefined" &&
     typeof process.versions?.node === "string" &&
     !("__cf_env" in globalThis) &&
+    !("__env__" in globalThis) &&
     !("Deno" in globalThis)
   );
 }
@@ -20,6 +21,7 @@ export function isNodeRuntime(): boolean {
 export function isCloudflareRuntime(): boolean {
   return (
     "__cf_env" in globalThis ||
+    "__env__" in globalThis ||
     (typeof navigator !== "undefined" &&
       navigator.userAgent === "Cloudflare-Workers")
   );

package/corpus/core/src/templates/default/.agents/skills/secrets/SKILL.md

@@ -151,6 +151,35 @@ Rules:
 - **Scope matches the registration.** `scope: "user"` → pass the user email.
   `scope: "workspace"` → pass the active `orgId` from
   `getOrgContext(event).orgId`.
+- **One resolver per key, and every runtime path goes through it.** Before
+  reading a credential, grep the app for the key name. If a resolver already
+  exists (`resolveXConfig`, a connector, a client factory), call it — do not
+  read `process.env` for that key a second time somewhere else.
+- **Identity comes from the caller, not the module.** A shared helper under
+  `server/lib/` takes the email as a parameter; only an entrypoint (action,
+  route, cron) decides whose identity it is. A library that resolves its own
+  identity from `process.env.AGENT_USER_EMAIL` authorizes the deployment rather
+  than the caller.
+
+The failure this prevents is not a leak — it is a split brain. When the config
+check reads the vault and the feature reads `process.env`, the settings UI and
+onboarding checklist report the integration as **configured** while every actual
+call fails with "env var is required". The credential is right there in the
+vault, so the error names the wrong cause and sends everyone hunting for a sync
+or redeploy problem that does not exist. This has now shipped four times in one
+app (BigQuery, Jira, Pylon, Academy).
+
+Before finishing any change that touches a credential, run the guard from the
+app directory — it finds this whether the app lives in `templates/` or in a
+workspace repo:
+
+```bash
+npx agent-native doctor --only no-env-credentials
+```
+
+Findings in files that already call `resolveCredential` are usually the
+sanctioned `resolveCredential(key, ctx) ?? process.env.KEY` fallback. The bugs
+are the files with **no** resolver at all.
 
 ## HTTP routes
 

package/corpus/core/src/templates/default/app/i18n/ar-SA.ts

@@ -92,19 +92,19 @@ const messages = {
       curatedTemplates: "قوالب منسقة",
       curatedTemplatesDescription:
         "ابدأ من شكل تطبيق تمت مراجعته، ثم اجعله خاصًا بك.",
-      remix: "إعادة المزج",
-      remixTemplate: "إعادة مزج {{name}}",
+      remix: "إنشاء من قالب",
+      remixTemplate: "إنشاء تطبيق {{name}}",
       remixAppIdLabel: "معرّف التطبيق الجديد",
-      remixStarted: "بدأت إعادة مزج {{name}}",
+      remixStarted: "بدأ إنشاء {{name}}",
       viewLiveApp: "عرض التطبيق المباشر",
       alreadyInWorkspace: "موجود بالفعل في مساحة العمل",
       remixAppIdDescription:
         "اختر معرّفًا آمنًا لعنوان URL لتطبيق مساحة العمل الجديد.",
       integrationSetup: "إعداد التكامل",
       source: "المصدر",
-      remixing: "جارٍ إعادة المزج…",
-      remixSuccess: "بدأت إعادة مزج القالب.",
-      remixError: "تعذرت إعادة مزج هذا القالب",
+      remixing: "جارٍ إنشاء التطبيق…",
+      remixSuccess: "بدأ إنشاء التطبيق من القالب.",
+      remixError: "تعذر إنشاء تطبيق من هذا القالب",
       appIdRequired: "معرّف التطبيق مطلوب.",
       hide: "إخفاء",
       show: "Show",

package/corpus/core/src/templates/default/app/i18n/de-DE.ts

@@ -91,19 +91,19 @@ const messages = {
       curatedTemplates: "Kuratierte Vorlagen",
       curatedTemplatesDescription:
         "Starte mit einer geprüften App-Struktur und passe sie an.",
-      remix: "Remix",
-      remixTemplate: "{{name}} remixen",
+      remix: "Aus Vorlage erstellen",
+      remixTemplate: "{{name}}-App erstellen",
       remixAppIdLabel: "Neue App-ID",
-      remixStarted: "Remix für {{name}} gestartet",
+      remixStarted: "Erstellung von {{name}} gestartet",
       viewLiveApp: "Live-App öffnen",
       alreadyInWorkspace: "Bereits im Workspace",
       remixAppIdDescription:
         "Wähle eine URL-sichere ID für die neue Workspace-App.",
       integrationSetup: "Integration einrichten",
       source: "Quelle",
-      remixing: "Remix wird erstellt…",
-      remixSuccess: "Template-Remix gestartet.",
-      remixError: "Dieses Template konnte nicht geremixt werden",
+      remixing: "App wird erstellt…",
+      remixSuccess: "Erstellung der App aus der Vorlage gestartet.",
+      remixError: "App konnte nicht aus dieser Vorlage erstellt werden",
       appIdRequired: "App-ID ist erforderlich.",
       hide: "Ausblenden",
       show: "Show",

package/corpus/core/src/templates/default/app/i18n/en-US.ts

@@ -89,19 +89,19 @@ const messages = {
       curatedTemplates: "Curated templates",
       curatedTemplatesDescription:
         "Start from a reviewed app shape, then make it your own.",
-      remix: "Remix",
-      remixTemplate: "Remix {{name}}",
+      remix: "Create from template",
+      remixTemplate: "Create {{name}} app",
       remixAppIdLabel: "New app id",
-      remixStarted: "Started {{name}} remix",
+      remixStarted: "Started creating {{name}}",
       viewLiveApp: "View live app",
       alreadyInWorkspace: "Already in workspace",
       remixAppIdDescription:
         "Choose the URL-safe id for the new workspace app.",
       integrationSetup: "Integration setup",
       source: "Source",
-      remixing: "Remixing…",
-      remixSuccess: "Template remix started.",
-      remixError: "Could not remix this template",
+      remixing: "Creating app…",
+      remixSuccess: "Template app creation started.",
+      remixError: "Could not create an app from this template",
       appIdRequired: "App ID is required.",
       hide: "Hide",
       show: "Show",

package/corpus/core/src/templates/default/app/i18n/es-ES.ts

@@ -91,19 +91,19 @@ const messages = {
       curatedTemplates: "Plantillas seleccionadas",
       curatedTemplatesDescription:
         "Empieza con una estructura de aplicación revisada y hazla tuya.",
-      remix: "Reutilizar",
-      remixTemplate: "Reutilizar {{name}}",
+      remix: "Crear desde plantilla",
+      remixTemplate: "Crear app de {{name}}",
       remixAppIdLabel: "Nuevo ID de aplicación",
-      remixStarted: "Se inició la reutilización de {{name}}",
+      remixStarted: "Se inició la creación de {{name}}",
       viewLiveApp: "Ver aplicación en vivo",
       alreadyInWorkspace: "Ya está en el espacio de trabajo",
       remixAppIdDescription:
         "Elige un ID seguro para URL para la nueva aplicación.",
       integrationSetup: "Configuración de integración",
       source: "Origen",
-      remixing: "Reutilizando…",
-      remixSuccess: "Se inició la reutilización de la plantilla.",
-      remixError: "No se pudo reutilizar esta plantilla",
+      remixing: "Creando app…",
+      remixSuccess: "Se inició la creación de la app desde la plantilla.",
+      remixError: "No se pudo crear una app desde esta plantilla",
       appIdRequired: "El ID de aplicación es obligatorio.",
       hide: "Ocultar",
       show: "Show",

package/corpus/core/src/templates/default/app/i18n/fr-FR.ts

@@ -93,19 +93,19 @@ const messages = {
       curatedTemplates: "Modèles sélectionnés",
       curatedTemplatesDescription:
         "Partez d’une structure d’application vérifiée et personnalisez-la.",
-      remix: "Remixer",
-      remixTemplate: "Remixer {{name}}",
+      remix: "Créer à partir du modèle",
+      remixTemplate: "Créer l’app {{name}}",
       remixAppIdLabel: "Nouvel identifiant d’application",
-      remixStarted: "Remix de {{name}} lancé",
+      remixStarted: "Création de {{name}} démarrée",
       viewLiveApp: "Voir l’application en direct",
       alreadyInWorkspace: "Déjà dans l’espace de travail",
       remixAppIdDescription:
         "Choisissez un identifiant compatible avec l’URL pour la nouvelle application.",
       integrationSetup: "Configuration de l’intégration",
       source: "Source",
-      remixing: "Remix en cours…",
-      remixSuccess: "Le remix du modèle a démarré.",
-      remixError: "Impossible de remixer ce modèle",
+      remixing: "Création de l’app…",
+      remixSuccess: "Création de l’app à partir du modèle démarrée.",
+      remixError: "Impossible de créer une app à partir de ce modèle",
       appIdRequired: "L’identifiant de l’application est requis.",
       hide: "Masquer",
       show: "Show",

package/corpus/core/src/templates/default/app/i18n/hi-IN.ts

@@ -87,18 +87,18 @@ const messages = {
       curatedTemplates: "चयनित टेम्पलेट",
       curatedTemplatesDescription:
         "समीक्षित ऐप संरचना से शुरू करें और इसे अपने अनुसार बनाएं।",
-      remix: "रीमिक्स",
-      remixTemplate: "{{name}} रीमिक्स करें",
+      remix: "टेम्पलेट से बनाएं",
+      remixTemplate: "{{name}} ऐप बनाएं",
       remixAppIdLabel: "नया ऐप आईडी",
-      remixStarted: "{{name}} रीमिक्स शुरू हुआ",
+      remixStarted: "{{name}} बनाना शुरू किया",
       viewLiveApp: "लाइव ऐप देखें",
       alreadyInWorkspace: "वर्कस्पेस में पहले से मौजूद",
       remixAppIdDescription: "नए वर्कस्पेस ऐप के लिए URL-सुरक्षित आईडी चुनें।",
       integrationSetup: "इंटीग्रेशन सेटअप",
       source: "स्रोत",
-      remixing: "रीमिक्स हो रहा है…",
-      remixSuccess: "टेम्पलेट रीमिक्स शुरू हुआ।",
-      remixError: "यह टेम्पलेट रीमिक्स नहीं हो सका",
+      remixing: "ऐप बनाया जा रहा है…",
+      remixSuccess: "टेम्पलेट से ऐप बनाना शुरू किया गया।",
+      remixError: "इस टेम्पलेट से ऐप नहीं बना सके",
       appIdRequired: "ऐप आईडी आवश्यक है।",
       hide: "छिपाएं",
       show: "Show",

package/corpus/core/src/templates/default/app/i18n/ja-JP.ts

@@ -89,19 +89,19 @@ const messages = {
       curatedTemplates: "厳選テンプレート",
       curatedTemplatesDescription:
         "レビュー済みのアプリ構成をベースに、自分用にカスタマイズできます。",
-      remix: "リミックス",
-      remixTemplate: "{{name}} をリミックス",
+      remix: "テンプレートから作成",
+      remixTemplate: "{{name}} アプリを作成",
       remixAppIdLabel: "新しいアプリ ID",
-      remixStarted: "{{name}} のリミックスを開始しました",
+      remixStarted: "{{name}} の作成を開始しました",
       viewLiveApp: "ライブアプリを見る",
       alreadyInWorkspace: "ワークスペースに追加済み",
       remixAppIdDescription:
         "新しいワークスペースアプリの URL セーフな ID を選択してください。",
       integrationSetup: "連携の設定",
       source: "提供元",
-      remixing: "リミックス中…",
-      remixSuccess: "テンプレートのリミックスを開始しました。",
-      remixError: "このテンプレートをリミックスできませんでした",
+      remixing: "アプリを作成中…",
+      remixSuccess: "テンプレートからのアプリ作成を開始しました。",
+      remixError: "このテンプレートからアプリを作成できませんでした",
       appIdRequired: "アプリ ID は必須です。",
       hide: "非表示",
       show: "Show",

package/corpus/core/src/templates/default/app/i18n/ko-KR.ts

@@ -88,18 +88,18 @@ const messages = {
       curatedTemplates: "엄선된 템플릿",
       curatedTemplatesDescription:
         "검토된 앱 구조에서 시작해 나만의 앱으로 만들어 보세요.",
-      remix: "리믹스",
-      remixTemplate: "{{name}} 리믹스",
+      remix: "템플릿에서 만들기",
+      remixTemplate: "{{name}} 앱 만들기",
       remixAppIdLabel: "새 앱 ID",
-      remixStarted: "{{name}} 리믹스를 시작했습니다",
+      remixStarted: "{{name}} 생성을 시작했습니다",
       viewLiveApp: "라이브 앱 보기",
       alreadyInWorkspace: "워크스페이스에 이미 있음",
       remixAppIdDescription: "새 워크스페이스 앱의 URL 안전 ID를 선택하세요.",
       integrationSetup: "연동 설정",
       source: "소스",
-      remixing: "리믹스 중…",
-      remixSuccess: "템플릿 리믹스를 시작했습니다.",
-      remixError: "이 템플릿을 리믹스할 수 없습니다",
+      remixing: "앱 만드는 중…",
+      remixSuccess: "템플릿에서 앱 만들기를 시작했습니다.",
+      remixError: "이 템플릿에서 앱을 만들 수 없습니다",
       appIdRequired: "앱 ID가 필요합니다.",
       hide: "숨기기",
       show: "Show",

package/corpus/core/src/templates/default/app/i18n/pt-BR.ts

@@ -92,19 +92,19 @@ const messages = {
       curatedTemplates: "Modelos selecionados",
       curatedTemplatesDescription:
         "Comece com uma estrutura de app revisada e personalize-a.",
-      remix: "Remixar",
-      remixTemplate: "Remixar {{name}}",
+      remix: "Criar a partir do modelo",
+      remixTemplate: "Criar app {{name}}",
       remixAppIdLabel: "Novo ID do app",
-      remixStarted: "Remix de {{name}} iniciado",
+      remixStarted: "Criação de {{name}} iniciada",
       viewLiveApp: "Ver app ao vivo",
       alreadyInWorkspace: "Já está no workspace",
       remixAppIdDescription:
         "Escolha um ID seguro para URL para o novo app do workspace.",
       integrationSetup: "Configuração da integração",
       source: "Origem",
-      remixing: "Remixando…",
-      remixSuccess: "Remix do modelo iniciado.",
-      remixError: "Não foi possível remixar este modelo",
+      remixing: "Criando app…",
+      remixSuccess: "Criação do app a partir do modelo iniciada.",
+      remixError: "Não foi possível criar um app a partir deste modelo",
       appIdRequired: "O ID do app é obrigatório.",
       hide: "Ocultar",
       show: "Show",

package/corpus/core/src/templates/default/app/i18n/zh-CN.ts

@@ -85,18 +85,18 @@ const messages = {
       curatedTemplates: "精选模板",
       curatedTemplatesDescription:
         "从经过审核的应用结构开始，然后打造属于你的应用。",
-      remix: "再创作",
-      remixTemplate: "再创作 {{name}}",
+      remix: "从模板创建",
+      remixTemplate: "创建 {{name}} 应用",
       remixAppIdLabel: "新应用 ID",
-      remixStarted: "已开始再创作 {{name}}",
+      remixStarted: "已开始创建 {{name}}",
       viewLiveApp: "查看在线应用",
       alreadyInWorkspace: "已在工作区中",
       remixAppIdDescription: "为新的工作区应用选择一个 URL 安全的 ID。",
       integrationSetup: "集成设置",
       source: "来源",
-      remixing: "正在再创作…",
-      remixSuccess: "已开始再创作模板。",
-      remixError: "无法再创作此模板",
+      remixing: "正在创建应用…",
+      remixSuccess: "已开始从模板创建应用。",
+      remixError: "无法从此模板创建应用",
       appIdRequired: "应用 ID 是必填项。",
       hide: "隐藏",
       show: "Show",

package/corpus/core/src/templates/default/app/i18n/zh-TW.ts

@@ -85,18 +85,18 @@ const messages = {
       curatedTemplates: "精選範本",
       curatedTemplatesDescription:
         "從經過審核的應用程式結構開始，打造屬於你的應用程式。",
-      remix: "重新混搭",
-      remixTemplate: "重新混搭 {{name}}",
+      remix: "從範本建立",
+      remixTemplate: "建立 {{name}} 應用程式",
       remixAppIdLabel: "新應用程式 ID",
-      remixStarted: "已開始重新混搭 {{name}}",
+      remixStarted: "已開始建立 {{name}}",
       viewLiveApp: "查看線上應用程式",
       alreadyInWorkspace: "已在工作區中",
       remixAppIdDescription: "為新的工作區應用程式選擇 URL 安全的 ID。",
       integrationSetup: "整合設定",
       source: "來源",
-      remixing: "正在重新混搭…",
-      remixSuccess: "已開始重新混搭範本。",
-      remixError: "無法重新混搭此範本",
+      remixing: "正在建立應用程式…",
+      remixSuccess: "已開始從範本建立應用程式。",
+      remixError: "無法從此範本建立應用程式",
       appIdRequired: "應用程式 ID 為必填項目。",
       hide: "隱藏",
       show: "Show",

package/corpus/core/src/templates/headless/.agents/skills/secrets/SKILL.md

@@ -151,6 +151,35 @@ Rules:
 - **Scope matches the registration.** `scope: "user"` → pass the user email.
   `scope: "workspace"` → pass the active `orgId` from
   `getOrgContext(event).orgId`.
+- **One resolver per key, and every runtime path goes through it.** Before
+  reading a credential, grep the app for the key name. If a resolver already
+  exists (`resolveXConfig`, a connector, a client factory), call it — do not
+  read `process.env` for that key a second time somewhere else.
+- **Identity comes from the caller, not the module.** A shared helper under
+  `server/lib/` takes the email as a parameter; only an entrypoint (action,
+  route, cron) decides whose identity it is. A library that resolves its own
+  identity from `process.env.AGENT_USER_EMAIL` authorizes the deployment rather
+  than the caller.
+
+The failure this prevents is not a leak — it is a split brain. When the config
+check reads the vault and the feature reads `process.env`, the settings UI and
+onboarding checklist report the integration as **configured** while every actual
+call fails with "env var is required". The credential is right there in the
+vault, so the error names the wrong cause and sends everyone hunting for a sync
+or redeploy problem that does not exist. This has now shipped four times in one
+app (BigQuery, Jira, Pylon, Academy).
+
+Before finishing any change that touches a credential, run the guard from the
+app directory — it finds this whether the app lives in `templates/` or in a
+workspace repo:
+
+```bash
+npx agent-native doctor --only no-env-credentials
+```
+
+Findings in files that already call `resolveCredential` are usually the
+sanctioned `resolveCredential(key, ctx) ?? process.env.KEY` fallback. The bugs
+are the files with **no** resolver at all.
 
 ## HTTP routes
 

package/corpus/core/src/templates/workspace-core/.agents/skills/secrets/SKILL.md

@@ -151,6 +151,35 @@ Rules:
 - **Scope matches the registration.** `scope: "user"` → pass the user email.
   `scope: "workspace"` → pass the active `orgId` from
   `getOrgContext(event).orgId`.
+- **One resolver per key, and every runtime path goes through it.** Before
+  reading a credential, grep the app for the key name. If a resolver already
+  exists (`resolveXConfig`, a connector, a client factory), call it — do not
+  read `process.env` for that key a second time somewhere else.
+- **Identity comes from the caller, not the module.** A shared helper under
+  `server/lib/` takes the email as a parameter; only an entrypoint (action,
+  route, cron) decides whose identity it is. A library that resolves its own
+  identity from `process.env.AGENT_USER_EMAIL` authorizes the deployment rather
+  than the caller.
+
+The failure this prevents is not a leak — it is a split brain. When the config
+check reads the vault and the feature reads `process.env`, the settings UI and
+onboarding checklist report the integration as **configured** while every actual
+call fails with "env var is required". The credential is right there in the
+vault, so the error names the wrong cause and sends everyone hunting for a sync
+or redeploy problem that does not exist. This has now shipped four times in one
+app (BigQuery, Jira, Pylon, Academy).
+
+Before finishing any change that touches a credential, run the guard from the
+app directory — it finds this whether the app lives in `templates/` or in a
+workspace repo:
+
+```bash
+npx agent-native doctor --only no-env-credentials
+```
+
+Findings in files that already call `resolveCredential` are usually the
+sanctioned `resolveCredential(key, ctx) ?? process.env.KEY` fallback. The bugs
+are the files with **no** resolver at all.
 
 ## HTTP routes
 

package/corpus/core/src/vite/client.ts

@@ -22,6 +22,7 @@ import {
   parsePendingEntry,
 } from "../changelog/parse.js";
 import { getViteDevRecoveryScript } from "../client/vite-dev-recovery-script.js";
+import { writeAgentNativeNitroPresetMarker } from "../deploy/nitro-preset.js";
 import { findWorkspaceRoot } from "../scripts/utils.js";
 import { verifyEmbedSessionToken } from "../server/embed-session.js";
 import {
@@ -1387,7 +1388,7 @@ function getCoreSourceAliases(
 }
 
 export interface NitroOptions {
-  /** Nitro deployment preset (e.g. "node", "vercel", "netlify", "cloudflare_pages"). Default: "node" */
+  /** Nitro deployment preset (e.g. "node", "vercel", "netlify", "cloudflare_pages", "cloudflare_module"). Default: "node" */
   preset?: string;
   /** Source directory for server files. Default: "./server" */
   srcDir?: string;
@@ -2964,6 +2965,22 @@ function forceServeOnly(pluginOrPreset: any): any {
   return { ...pluginOrPreset, apply: "serve" };
 }
 
+function nitroPresetMarkerPlugin(
+  options: ClientConfigOptions | AgentNativeVitePluginOptions,
+): Plugin | null {
+  const preset = options.nitro?.preset;
+  if (typeof preset !== "string" || !preset.trim()) return null;
+
+  return {
+    name: "agent-native-nitro-preset-marker",
+    configResolved(config) {
+      if (config.command === "build") {
+        writeAgentNativeNitroPresetMarker(preset);
+      }
+    },
+  };
+}
+
 function createAgentNativePlugins(
   options: ClientConfigOptions | AgentNativeVitePluginOptions,
   {
@@ -2981,8 +2998,10 @@ function createAgentNativePlugins(
   const { appBasePath } = getConfiguredAppBasePath();
   const nitroPlugin = createNitroDevPlugin(options, appBasePath);
   const includeNitro = !isBuildCommand(command);
+  const presetMarkerPlugin = nitroPresetMarkerPlugin(options);
 
   return [
+    presetMarkerPlugin,
     // Stub packages from `options.ssrStubs` in the SSR bundle so they
     // don't bloat the edge worker. Opt-in per template — the framework
     // hardcodes nothing (e.g. docs sites legitimately import `shiki` on