@agent-native/core 0.131.9 → 0.132.0

package/corpus/core/src/scripts/runner.ts

@@ -17,7 +17,10 @@ import { pathToFileURL } from "url";
 
 import type { ActionEntry } from "../agent/production-agent.js";
 import { closeDbExec } from "../db/client.js";
-import { notifyActionChange } from "../server/action-change.js";
+import {
+  actionCallIsReadOnly,
+  notifyActionChange,
+} from "../server/action-change.js";
 import {
   runWithRequestContext,
   getRequestOrgId,
@@ -442,7 +445,7 @@ async function dispatchAction(
       ) {
         const parsed = parseActionArgs(args, { coerceBooleans: true });
         const result = await handler.run(parsed, cliActionCtx(actionName));
-        if (handler.readOnly !== true) {
+        if (!actionCallIsReadOnly(handler, parsed, false)) {
           await notifyActionChange({ actionName }).catch(() => {});
         }
         if (result) assertCliHandoffLaunched(printActionResult(result));
@@ -476,7 +479,7 @@ async function dispatchAction(
         parsed as Record<string, string>,
         cliActionCtx(actionName),
       );
-      if (packageAction.readOnly !== true) {
+      if (!actionCallIsReadOnly(packageAction, parsed, false)) {
         await notifyActionChange({ actionName }).catch(() => {});
       }
       if (result) assertCliHandoffLaunched(printActionResult(result));

package/corpus/core/src/secrets/storage.ts

@@ -16,6 +16,7 @@ import { randomUUID } from "node:crypto";
 
 import { getDbExec, isPostgres } from "../db/client.js";
 import { ensureColumnExists, ensureTableExists } from "../db/ddl-guard.js";
+import { getRequestContext } from "../server/request-context.js";
 import {
   encryptSecretValue as encryptLegacyValue,
   encryptSharedSecretValue as encryptValue,
@@ -217,6 +218,8 @@ export async function writeAppSecret(args: WriteSecretArgs): Promise<string> {
     now,
   ];
 
+  invalidateRequestSecret(args);
+
   if (isPostgres()) {
     const { rows } = await client.execute({
       sql: `${upsertSql} RETURNING id`,
@@ -339,6 +342,52 @@ async function populateSharedAppSecret(
   }
 }
 
+// ---------------------------------------------------------------------------
+// Per-request read memo
+// ---------------------------------------------------------------------------
+
+/**
+ * Per-request memo of secret reads, keyed on the active AsyncLocalStorage
+ * RequestContext (WeakMap → freed with the request). Mirrors the settings
+ * store's cache, including its staleness rule: a write in THIS request is
+ * written through, while other in-flight requests keep their snapshot for
+ * their own (short) lifetime.
+ *
+ * The map key is `scope|scopeId|key`, which is the secret's full identity —
+ * `user:<email>`, `org:<id>`, `solo:<email>`, `workspace` — so a hit can never
+ * answer one caller with another caller's secret. Do NOT reduce the key to
+ * just `key`.
+ *
+ * This exists because one credential resolution is a WATERFALL: user scope,
+ * then org, then workspace, then solo. Callers re-resolve the same credential
+ * several times per request (engine detection, config resolution, usability
+ * checks), and against a remote database each probe is a network round trip.
+ */
+const _requestSecretsCache = new WeakMap<
+  object,
+  Map<string, ReadSecretResult | null>
+>();
+
+function requestSecretsCache(): Map<string, ReadSecretResult | null> | null {
+  const ctx = getRequestContext();
+  if (!ctx || typeof ctx !== "object") return null;
+  let cache = _requestSecretsCache.get(ctx);
+  if (!cache) {
+    cache = new Map();
+    _requestSecretsCache.set(ctx, cache);
+  }
+  return cache;
+}
+
+function secretCacheKey(ref: SecretRef): string {
+  return `${ref.scope}|${ref.scopeId}|${ref.key}`;
+}
+
+/** Drop this request's memo for a secret whose stored value just changed. */
+function invalidateRequestSecret(ref: SecretRef): void {
+  requestSecretsCache()?.delete(secretCacheKey(ref));
+}
+
 type AppSecretsReadQuery = { sql: string; args: unknown[] };
 
 /**
@@ -379,6 +428,17 @@ async function executeAppSecretsRead(query: AppSecretsReadQuery) {
  */
 export async function readAppSecret(
   ref: SecretRef,
+): Promise<ReadSecretResult | null> {
+  const cache = requestSecretsCache();
+  const cacheKey = secretCacheKey(ref);
+  if (cache?.has(cacheKey)) return cache.get(cacheKey) ?? null;
+  const result = await readAppSecretUncached(ref);
+  cache?.set(cacheKey, result);
+  return result;
+}
+
+async function readAppSecretUncached(
+  ref: SecretRef,
 ): Promise<ReadSecretResult | null> {
   const { key, scope, scopeId } = ref;
   const { rows } = await executeAppSecretsRead({
@@ -417,15 +477,41 @@ export async function readAppSecrets(args: {
   scope: SecretScope;
   scopeId: string;
 }): Promise<Map<string, ReadSecretResult>> {
-  const keys = [...new Set(args.keys.filter(Boolean))];
-  if (keys.length === 0) return new Map();
+  const requested = [...new Set(args.keys.filter(Boolean))];
+  if (requested.length === 0) return new Map();
+
+  const cache = requestSecretsCache();
+  const results = new Map<string, ReadSecretResult>();
+  const keys: string[] = [];
+  for (const key of requested) {
+    const cacheKey = secretCacheKey({
+      key,
+      scope: args.scope,
+      scopeId: args.scopeId,
+    });
+    if (cache?.has(cacheKey)) {
+      const cached = cache.get(cacheKey);
+      if (cached) results.set(key, cached);
+      continue;
+    }
+    keys.push(key);
+  }
+  if (keys.length === 0) return results;
 
   const placeholders = keys.map(() => "?").join(", ");
   const { rows } = await executeAppSecretsRead({
     sql: `SELECT key, encrypted_value, shared_encrypted_value, updated_at, id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key IN (${placeholders})`,
     args: [args.scope, args.scopeId, ...keys],
   });
-  const results = new Map<string, ReadSecretResult>();
+  // The statement covered every uncached key in this scope, so a key missing
+  // from `rows` is genuinely absent — memo it as such rather than leaving a
+  // single-key read to go ask again.
+  for (const key of keys) {
+    cache?.set(
+      secretCacheKey({ key, scope: args.scope, scopeId: args.scopeId }),
+      null,
+    );
+  }
   for (const row of rows) {
     const key = String(row.key ?? "");
     if (!key) continue;
@@ -442,11 +528,16 @@ export async function readAppSecrets(args: {
           decrypted.sharedCiphertextToReplace ?? null,
         );
       }
-      results.set(key, {
+      const result = {
         value: decrypted.value,
         last4: last4(decrypted.value),
         updatedAt: Number(row.updated_at ?? 0),
-      });
+      };
+      results.set(key, result);
+      cache?.set(
+        secretCacheKey({ key, scope: args.scope, scopeId: args.scopeId }),
+        result,
+      );
     } catch {
       // Match readAppSecret: corrupted or stale ciphertext behaves as missing.
     }
@@ -589,6 +680,7 @@ function parseAllowlist(raw: string | null): string[] | null {
 
 export async function deleteAppSecret(ref: SecretRef): Promise<boolean> {
   await ensureTable();
+  invalidateRequestSecret(ref);
   const { key, scope, scopeId } = ref;
   const client = getDbExec();
   const { rowsAffected } = await client.execute({

package/corpus/core/src/server/action-change.ts

@@ -4,10 +4,43 @@ import {
   actionChangeMarkerValue,
   type ActionChangeTarget,
 } from "../action-change-marker.js";
+import type { ActionPlanModeConfig } from "../action.js";
 import { appStatePut } from "../application-state/store.js";
 import { recordChange } from "./poll.js";
 import { getRequestOrgId, getRequestUserEmail } from "./request-context.js";
 
+/**
+ * Whether THIS invocation should announce a change.
+ *
+ * `readOnly` describes an action name, but a tool that discriminates on an
+ * argument reads on some calls and writes on others — `manage-agent-engine`
+ * with `action: "list"` is a status poll, with `action: "set"` a write. Such
+ * actions already publish the per-call answer as a Plan-mode `effect`
+ * predicate, so read it here instead of treating every call as a write: a poll
+ * that bumps the `"action"` change version makes every query keyed on it
+ * refetch forever.
+ *
+ * `readOnly` stays authoritative otherwise. Widening the flag to cover mixed
+ * tools would also open them to read-only A2A peers and to the agent's
+ * read-result cache, where it would be false.
+ */
+export function actionCallIsReadOnly(
+  entry: { readOnly?: boolean; planMode?: ActionPlanModeConfig<any> },
+  params: unknown,
+  fallback: boolean,
+): boolean {
+  const effect = entry.planMode?.effect;
+  if (typeof effect === "function") {
+    try {
+      return effect(params) === "read";
+    } catch {
+      // A predicate that throws says nothing; fall through to the flag.
+    }
+  }
+  if (typeof entry.readOnly === "boolean") return entry.readOnly;
+  return fallback;
+}
+
 export interface NotifyActionChangeOptions {
   actionName: string;
   owner?: string;

package/corpus/core/src/server/action-routes.ts

@@ -21,7 +21,7 @@ import {
   MCP_EMBED_CORS_ALLOW_HEADERS,
   shouldAllowMcpEmbedCredentials,
 } from "../shared/mcp-embed-headers.js";
-import { notifyActionChange } from "./action-change.js";
+import { actionCallIsReadOnly, notifyActionChange } from "./action-change.js";
 import {
   seedAgentRunOwnerContext,
   type AgentRunOwnerContext,
@@ -603,14 +603,16 @@ export function mountActionRoutes(
               // their action queries. The calling tab already refetches via
               // useActionMutation's onSuccess, so this is mainly cross-tab
               // sync (and parity with the agent's tool-call path).
-              // Explicit entry.readOnly (true OR false) wins over the method
-              // heuristic. defineAction already auto-infers GET → readOnly=true,
-              // so for actions registered through that path entry.readOnly is
-              // always set and the fallback just guards legacy wrap paths.
-              const isReadOnly =
-                typeof entry.readOnly === "boolean"
-                  ? entry.readOnly
-                  : method === "GET";
+              // A per-call Plan-mode effect wins over entry.readOnly, which
+              // wins (true OR false) over the method heuristic. defineAction
+              // already auto-infers GET → readOnly=true, so for actions
+              // registered through that path entry.readOnly is always set and
+              // the fallback just guards legacy wrap paths.
+              const isReadOnly = actionCallIsReadOnly(
+                entry,
+                params,
+                method === "GET",
+              );
               if (!isReadOnly) {
                 try {
                   await notifyActionChange({

package/corpus/core/src/server/agent-teams.ts

@@ -57,6 +57,7 @@ import {
   listAppState,
   deleteAppState,
 } from "../application-state/script-helpers.js";
+import { redactArgsToValue, redactTextToSummary } from "../audit/redact.js";
 import { createThread } from "../chat-threads/store.js";
 import type {
   BackgroundAgentRun,
@@ -1112,13 +1113,20 @@ function summarizeAgentChatEvent(event: RunEvent): {
       return {
         kind: "status",
         message: `Running ${payload.tool}`,
-        metadata: { tool: payload.tool, input: payload.input },
+        metadata: {
+          tool: payload.tool,
+          input: redactArgsToValue(payload.input),
+        },
       };
     case "tool_done":
       return {
         kind: "artifact",
         message: payload.result,
-        metadata: { tool: payload.tool },
+        metadata: {
+          tool: payload.tool,
+          input: redactArgsToValue(payload.input),
+          result: redactTextToSummary(payload.result),
+        },
       };
     case "agent_task":
       return {

package/corpus/core/src/server/better-auth-instance.ts

@@ -38,6 +38,9 @@ import {
   pgPoolOptions,
   neonPoolMax,
   attachNeonPoolErrorLogger,
+  sharedDbPool,
+  onSharedDbPoolsClosed,
+  onSharedDbPoolReplaced,
 } from "../db/client.js";
 import { ensureTableExists } from "../db/ddl-guard.js";
 import { saveOAuthTokens } from "../oauth-tokens/store.js";
@@ -808,15 +811,34 @@ export async function getBetterAuthInternalAdapter(
 export async function resetBetterAuth(): Promise<void> {
   _auth = undefined;
   _initPromise = undefined;
-  if (_neonAuthPool) {
-    try {
-      await _neonAuthPool.end();
-    } catch {
-      // Pool may have already closed (process exiting, etc.) — don't block reset.
-    }
+  // The Postgres pool belongs to the process (see `sharedDbPool`), not to Better
+  // Auth — ending it here would take the framework's and every store's database
+  // access down with it. `closeDbExec()` owns that.
+  _neonAuthPool = undefined;
+  await closePgliteClients();
+}
+
+// A `closeDbExec()` releases the pool this instance's adapter is bound to, so
+// the next `getAuth()` must build a fresh one. Registered from the pooled
+// branches rather than at module load: core's specs widely mock
+// `db/client.js`, and an import-time call into the mock breaks every one of
+// them that doesn't stub this export.
+let _poolCloseHookRegistered = false;
+function resetAuthOnPoolClose(driver?: string, url?: string): void {
+  if (_poolCloseHookRegistered) return;
+  _poolCloseHookRegistered = true;
+  onSharedDbPoolsClosed(() => {
+    _auth = undefined;
+    _initPromise = undefined;
     _neonAuthPool = undefined;
+  });
+  if (driver && url) {
+    onSharedDbPoolReplaced(driver, url, () => {
+      _auth = undefined;
+      _initPromise = undefined;
+      _neonAuthPool = undefined;
+    });
   }
-  await closePgliteClients();
 }
 
 // ---------------------------------------------------------------------------
@@ -1160,10 +1182,12 @@ async function buildDatabaseConfig(
       // session lookup on essentially every authenticated request, so an
       // un-capped pool here is a primary contributor to "Max client
       // connections reached" across concurrent serverless instances.
-      _neonAuthPool = new Pool({
-        connectionString: url,
-        max: neonPoolMax(),
-      });
+      resetAuthOnPoolClose("neon", url);
+      _neonAuthPool = sharedDbPool(
+        "neon",
+        url,
+        () => new Pool({ connectionString: url, max: neonPoolMax() }),
+      );
       attachNeonPoolErrorLogger(_neonAuthPool, "db/neon-auth");
       const { drizzle } = await import("drizzle-orm/neon-serverless");
       const db = drizzle(buildResilientNeonPool(_neonAuthPool), {
@@ -1182,7 +1206,10 @@ async function buildDatabaseConfig(
     // un-capped pool here is a primary contributor to "Max client connections
     // reached" across concurrent serverless instances.
     const { default: postgres } = await import("postgres");
-    const sql = postgres(url, pgPoolOptions(url));
+    resetAuthOnPoolClose("postgres-js", url);
+    const sql = sharedDbPool("postgres-js", url, () =>
+      postgres(url, pgPoolOptions(url)),
+    );
     const { drizzle } = await import("drizzle-orm/postgres-js");
     const db = drizzle(buildResilientPostgresJsClient(sql), {
       schema: pgAuthSchema,

package/corpus/core/src/server/core-routes-plugin.ts

@@ -46,6 +46,7 @@ import {
   putComposeDraft,
   deleteComposeDraft,
   deleteAllComposeDrafts,
+  getStateMany,
 } from "../application-state/handlers.js";
 import { mountBrowserSessionRoutes } from "../browser-sessions/routes.js";
 import { mountDbAdminRoutes } from "../db-admin/routes.js";
@@ -152,6 +153,7 @@ import {
 import type { EnvKeyConfig } from "./create-server.js";
 import {
   canUseDeployCredentialFallbackForRequest,
+  prefetchSecrets,
   readDeployCredentialEnv,
   resolveSecret,
 } from "./credential-provider.js";
@@ -1286,6 +1288,7 @@ export async function readLegacyCoreRouteInitSettings(
  *   GET    /_agent-native/health                        — DB liveness probe + scale-to-zero warmup
  *   GET    /_agent-native/env-status                    — env key configuration status (when envKeys provided)
  *   POST   /_agent-native/env-vars                      — compatibility route that saves keys to scoped DB secrets
+ *   GET    /_agent-native/application-state?keys=a,b,c  — batched read of many keys
  *   GET    /_agent-native/application-state/:key        — read application state
  *   PUT    /_agent-native/application-state/:key        — write application state
  *   DELETE /_agent-native/application-state/:key        — delete application state
@@ -3322,10 +3325,17 @@ export function createCoreRoutesPlugin(
                 /* org module not present in this template */
               }
             }
+            // One context for the whole sweep so the per-request secret memo is
+            // shared, and one batched read per scope to fill it. Without this
+            // every key pays its own four-scope waterfall.
+            const requestContext = { userEmail, orgId };
+            await runWithRequestContext(requestContext, () =>
+              prefetchSecrets(allowedEnvKeyNames),
+            );
             return Promise.all(
               envKeys.map(async (cfg) => {
                 const configured = await runWithRequestContext(
-                  { userEmail, orgId },
+                  requestContext,
                   () => resolveSecret(cfg.key).then(Boolean),
                 );
                 return {
@@ -4245,7 +4255,14 @@ export function createCoreRoutesPlugin(
               (event.url?.pathname || "").replace(/^\/+/, "").split("/")[0] ||
               "";
             // Skip — compose handler above already handled it
-            if (key === "compose" || key === "") return;
+            if (key === "compose") return;
+            // Collection root: `GET ?keys=a,b,c` batches many single-key reads
+            // into one request (and one identity resolution) — the chat rail
+            // alone reads ~6 keys on every mount.
+            if (key === "") {
+              if (getMethod(event) === "GET") return getStateMany(event);
+              return;
+            }
             if (event.context) {
               event.context.params = { ...event.context.params, key };
             }

package/corpus/core/src/server/credential-provider.ts

@@ -1276,11 +1276,50 @@ export async function deleteBuilderCredentials(
 // ANTHROPIC_API_KEY, but Builder identity keys keep the stricter scoped policy.
 // ---------------------------------------------------------------------------
 
+/**
+ * Warm this request's secret memo for many keys with one read per scope.
+ *
+ * `resolveSecret` walks four scopes per key, so a status endpoint asking about
+ * a dozen keys costs ~50 round trips against a remote database. Reading each
+ * scope once for the whole key set collapses that to four, and the subsequent
+ * `resolveSecret` calls answer from the per-request memo — same precedence,
+ * same identity scoping, no new cache to invalidate.
+ *
+ * Best-effort on purpose: `readAppSecrets` only memoizes keys a statement
+ * actually covered, so a failure here leaves each key's own lookup to run and
+ * report the failure. It must never turn an unreadable store into "not set".
+ */
+export async function prefetchSecrets(keys: readonly string[]): Promise<void> {
+  const email = getRequestUserEmail();
+  if (!email || keys.length === 0) return;
+  const { readAppSecrets } = await import("../secrets/storage.js");
+  const orgId =
+    getRequestOrgId() || (await resolveOrgIdForRequestEmail(email)).orgId;
+  const scopes: Array<{
+    scope: "user" | "org" | "workspace";
+    scopeId: string;
+  }> = [
+    { scope: "user", scopeId: email },
+    ...(orgId
+      ? ([
+          { scope: "org", scopeId: orgId },
+          { scope: "workspace", scopeId: orgId },
+        ] as const)
+      : []),
+    { scope: "workspace", scopeId: `solo:${email}` },
+  ];
+  await Promise.all(
+    scopes.map((s) => readAppSecrets({ keys, ...s }).catch(() => undefined)),
+  );
+}
+
 /**
  * Resolve a request-scoped secret. Reads from `app_secrets` first (current
  * user override, active org, workspace row for that org, then the solo
  * workspace row); falls back to `process.env` only when the deploy fallback
  * policy allows it.
+ *
+ * Resolving several keys in one request? Call `prefetchSecrets` first.
  */
 export async function resolveSecret(key: string): Promise<string | null> {
   const resolved = await resolveSecretDetailed(key);
@@ -1307,6 +1346,7 @@ export async function resolveSecretDetailed(
   if (email) {
     try {
       const { readAppSecret } = await import("../secrets/storage.js");
+
       // Per-user override first.
       const userSecret = await readAppSecret({
         key,
@@ -1333,14 +1373,25 @@ export async function resolveSecretDetailed(
         orgId = resolved.orgId;
       }
 
+      if (lookupFailed) {
+        return { value: null, lookupFailed: true, cause };
+      }
+
       if (orgId) {
+        // These rows are independent once the org is known, so read them in
+        // parallel while still applying precedence below in the same order.
+        const [orgRead, workspaceRead] = await Promise.allSettled([
+          readAppSecret({ key, scope: "org", scopeId: orgId }),
+          readAppSecret({ key, scope: "workspace", scopeId: orgId }),
+        ]);
+        const unwrap = <T>(settled: PromiseSettledResult<T>): T => {
+          if (settled.status === "rejected") throw settled.reason;
+          return settled.value;
+        };
+
         // Fall back to the active org's shared row, when present. Builder
         // Connect uses this first-class org scope.
-        const orgSecret = await readAppSecret({
-          key,
-          scope: "org",
-          scopeId: orgId,
-        });
+        const orgSecret = unwrap(orgRead);
         if (orgSecret?.value) {
           if (traceLookup) {
             console.log(
@@ -1353,11 +1404,7 @@ export async function resolveSecretDetailed(
         // Registered secrets historically used "workspace" scope for
         // org-shared configuration. Keep reading it so Settings status and
         // runtime resolution agree.
-        const workspaceSecret = await readAppSecret({
-          key,
-          scope: "workspace",
-          scopeId: orgId,
-        });
+        const workspaceSecret = unwrap(workspaceRead);
         if (workspaceSecret?.value) {
           if (traceLookup) {
             console.log(
@@ -1368,10 +1415,6 @@ export async function resolveSecretDetailed(
         }
       }
 
-      if (lookupFailed) {
-        return { value: null, lookupFailed: true, cause };
-      }
-
       // Solo-workspace fallback: always checked, even when an org id was found
       // above. A secret written before the user joined/created an org lives
       // here, and must not become unreachable once that org exists. It stays

package/corpus/core/src/server/http-response-telemetry.ts

@@ -367,6 +367,7 @@ export function installHttpResponseTelemetryHooks(nitroApp: any): void {
       );
     }
     if (state.db.operationCount > 0) {
+      appendServerTiming(response, event, "db-ops", state.db.operationCount);
       appendServerTiming(response, event, "db", state.db.operationWallMs);
       appendServerTiming(
         response,