@agent-native/core 0.132.2 → 0.133.1

package/src/agent/run-manager.ts

@@ -4,6 +4,11 @@ import {
   LLM_MISSING_CREDENTIALS_ERROR_CODE,
   LLM_MISSING_CREDENTIALS_MESSAGE,
 } from "./engine/credential-errors.js";
+import {
+  classifyTerminalErrorCode,
+  describeErrorWithCauses,
+  isProviderConnectionError,
+} from "./engine/error-detail.js";
 import { EngineError } from "./engine/types.js";
 import {
   insertRun,
@@ -341,23 +346,16 @@ function getRunErrorMessage(err: unknown): string {
   return "Unknown error";
 }
 
-function isProviderConnectionErrorMessage(message: string): boolean {
-  const normalized = message.trim().toLowerCase();
-  return (
-    normalized === "connection error." ||
-    normalized.includes("cannot connect to api:")
-  );
-}
-
 function getRunErrorCode(err: unknown): string | undefined {
   if (err instanceof EngineError) {
     if (err.errorCode) return err.errorCode;
     if (err.statusCode === 429) return PROVIDER_RATE_LIMITED_ERROR_CODE;
   }
-  if (err instanceof Error && isProviderConnectionErrorMessage(err.message)) {
-    return PROVIDER_NETWORK_ERROR_CODE;
-  }
-  return undefined;
+  if (isProviderConnectionError(err)) return PROVIDER_NETWORK_ERROR_CODE;
+  // The code rides the error EVENT to the client, which decides recovery from
+  // it — so an uncoded transport failure has to be classified here too, not
+  // only when the run row is persisted.
+  return classifyTerminalErrorCode(describeErrorWithCauses(err));
 }
 
 function getEngineRunErrorDetails(err: EngineError): string | undefined {
@@ -376,7 +374,7 @@ function shouldCaptureRunError(err: unknown): boolean {
   }
   if (!(err instanceof Error)) return true;
   if (/^40[13] status code\b/i.test(err.message)) return false;
-  if (isProviderConnectionErrorMessage(err.message)) return false;
+  if (isProviderConnectionError(err)) return false;
   if (!errorCode) return true;
   const normalizedCode = errorCode.toLowerCase();
   return (
@@ -984,6 +982,13 @@ export function startRun(
   // false-stale-reap zombie scenario where the reaper flipped the row while
   // this isolate was briefly unable to heartbeat (DB latency / GC pause).
   let lastAbortCheck = Date.now() - 3000;
+  // A read failure here used to be indistinguishable from "not aborted" —
+  // exactly the coerced-to-false pattern that lets a real Stop go unseen for
+  // the rest of the run. Count consecutive failures like the heartbeat-write
+  // handler above; past the same threshold, fail closed (self-abort with a
+  // reason outside TURN_ENDING_ABORT_REASONS/RECOVERABLE_ABORT_REASONS, so it
+  // surfaces as a typed error) instead of silently retrying forever.
+  let consecutiveAbortCheckFailures = 0;
   const checkSqlAbort = () => {
     const now = Date.now();
     if (now - lastAbortCheck < 3000) return;
@@ -1004,7 +1009,26 @@ export function startRun(
           }
         }
       })
-      .catch(() => {});
+      .then(() => {
+        consecutiveAbortCheckFailures = 0;
+      })
+      .catch((error) => {
+        consecutiveAbortCheckFailures += 1;
+        if (consecutiveAbortCheckFailures >= 3) {
+          captureError(error, {
+            route: "/_agent-native/agent-chat",
+            tags: {
+              source: "agent-run-manager",
+              phase: "abort-check",
+              consecutiveFailures: String(consecutiveAbortCheckFailures),
+            },
+            extra: { runId, threadId },
+          });
+          if (!abort.signal.aborted) {
+            abortInMemoryRun(run, "abort_check_unavailable");
+          }
+        }
+      });
   };
 
   // Heartbeat: bump heartbeat_at every 1.5s so watchers can detect a dead
@@ -1456,6 +1480,11 @@ export function startRun(
               ? completionError.message
               : String(completionError));
         }
+        // An engine that emitted an error event without a code has NOT told us
+        // the failure is unclassifiable — it told us nothing. Recover the code
+        // from the message before falling back to "unknown", which the client
+        // reads as "do not attempt recovery".
+        errorCode ??= classifyTerminalErrorCode(errorDetail);
         runTerminalErrorCode = errorCode ?? "unknown";
         runTerminalErrorDetail = errorDetail;
         await setRunError(runId, errorCode ?? "unknown", errorDetail);

package/src/agent/run-store.ts

@@ -736,7 +736,13 @@ function backgroundAwareStaleCutoffSql(): string {
   // `CAST(? AS BIGINT)` is required: without it Postgres infers the param as
   // int4 from the int4 window literals, so the bound `Date.now()` ms epoch
   // overflows int4. The cast keeps the subtraction 64-bit; a no-op on SQLite.
-  return `(CAST(? AS BIGINT) - CASE WHEN dispatch_mode = 'background-processing' THEN ${BACKGROUND_PROCESSING_RUN_STALE_MS} WHEN dispatch_mode LIKE 'background%' THEN ${BACKGROUND_RUN_STALE_MS} ELSE ${RUN_STALE_MS} END)`;
+  // The tight post-claim window buys ONE thing: reaching the durable successor
+  // sooner (see BACKGROUND_PROCESSING_RUN_STALE_MS). A row with no
+  // `dispatch_payload` has no successor to reach — `attemptStaleRunRecovery`
+  // declines it as `not_redispatchable` — so reaping it early is pure loss: it
+  // kills an in-process background automation (scheduler/trigger) that is still
+  // working, and nothing recovers it. Those get the wider background window.
+  return `(CAST(? AS BIGINT) - CASE WHEN dispatch_mode = 'background-processing' AND dispatch_payload IS NOT NULL THEN ${BACKGROUND_PROCESSING_RUN_STALE_MS} WHEN dispatch_mode LIKE 'background%' THEN ${BACKGROUND_RUN_STALE_MS} ELSE ${RUN_STALE_MS} END)`;
 }
 
 function terminalRunEventExclusionSql(runIdColumn = "id"): string {
@@ -946,6 +952,16 @@ export interface UnclaimedBackgroundRunRow {
    *  pre-inserted — independent of any liveness bump a redispatch attempt
    *  makes along the way. */
   startedAt: number;
+  /**
+   * Whether the row still carries the `dispatch_payload` a redispatched worker
+   * would rehydrate its request body from. Eligibility for this sweep does NOT
+   * imply it: a background row can reach the grace window having never had a
+   * payload at all. Redispatching one of those asserts `payloadRef: true` to a
+   * worker that then cannot rehydrate, so it kills the run as
+   * `dispatch_payload_missing` — a reason that reads like data loss for what is
+   * really an un-redispatchable handoff.
+   */
+  hasDispatchPayload: boolean;
 }
 
 /**
@@ -965,7 +981,10 @@ export async function listUnclaimedBackgroundRunRows(): Promise<
   const { rows } = await client.execute({
     // CAST keeps the ms-epoch param 64-bit on Postgres (see
     // backgroundAwareStaleCutoffSql for the int4-inference failure mode).
-    sql: `SELECT id, started_at FROM agent_runs
+    // Report payload presence rather than filtering on it: a payload-less row
+    // must still be VISIBLE to the sweep so the slow pass can reap it. Filtering
+    // it out here would leave it `running` forever.
+    sql: `SELECT id, started_at, (dispatch_payload IS NOT NULL) AS has_dispatch_payload FROM agent_runs
           WHERE status = 'running'
             AND dispatch_mode = 'background'
             AND COALESCE(heartbeat_at, started_at) < (CAST(? AS BIGINT) - ${UNCLAIMED_BACKGROUND_RUN_GRACE_MS})`,
@@ -975,11 +994,15 @@ export async function listUnclaimedBackgroundRunRows(): Promise<
   for (const row of rows ?? []) {
     const id = (row as { id?: unknown }).id;
     const startedAt = (row as { started_at?: unknown }).started_at;
+    const hasPayload = (row as { has_dispatch_payload?: unknown })
+      .has_dispatch_payload;
     if (typeof id === "string" && id) {
       result.push({
         id,
         startedAt:
           typeof startedAt === "number" ? startedAt : Number(startedAt) || 0,
+        // SQLite returns 1/0 where Postgres returns a boolean.
+        hasDispatchPayload: hasPayload === true || hasPayload === 1,
       });
     }
   }
@@ -1147,10 +1170,20 @@ export async function setRunTerminalReason(
     await ensureRunTables();
     const client = getDbExec();
     const reason = terminalReason.slice(0, 200);
+    // Write-once for a row that is already terminal. Three writers in three
+    // isolates race on this column — the mid-run checkpoint, the run-manager's
+    // finalization, and the background worker's failure path — with no ordering
+    // between them, and last-writer-wins let a late checkpoint relabel a row
+    // another isolate had already finalized. That produced impossible rows
+    // (status='errored' carrying a continuation reason, no error_code, no
+    // terminal event) and misattributed 130 production runs to a failure mode
+    // they never hit. A row still `running` has no honest reason yet, so it
+    // stays writable; once one is recorded on a terminal row, it stands.
+    const guard = `AND (status = 'running' OR terminal_reason IS NULL OR terminal_reason = '')`;
     await client.execute({
       sql: isContinuationTerminalReason(reason)
-        ? `UPDATE agent_runs SET terminal_reason = ?, status = CASE WHEN status = 'completed' THEN 'truncated' ELSE status END WHERE id = ?`
-        : `UPDATE agent_runs SET terminal_reason = ? WHERE id = ?`,
+        ? `UPDATE agent_runs SET terminal_reason = ?, status = CASE WHEN status = 'completed' THEN 'truncated' ELSE status END WHERE id = ? ${guard}`
+        : `UPDATE agent_runs SET terminal_reason = ? WHERE id = ? ${guard}`,
       args: [reason, runId],
     });
   } catch {
@@ -1519,7 +1552,7 @@ interface StaleRunRecoverySuccessor {
 type StaleRunRecoveryOutcome =
   | ({ outcome: "recovered" } & StaleRunRecoverySuccessor)
   | { outcome: "not_background" }
-  | { outcome: "payload_missing" }
+  | { outcome: "not_redispatchable" }
   | { outcome: "newer_run_exists" }
   | { outcome: "budget_exhausted" }
   | { outcome: "repeated_no_progress" };
@@ -1569,7 +1602,9 @@ function staleRecoveryDispatchPayload(payload: string): string {
  *   - the row is a background chat-turn dispatch (`dispatch_mode` starting
  *     with "background") — a foreground/foreground-self-chain run has a
  *     connected client to recover it via its own `auto_continue` re-POST.
- *   - its `dispatch_payload` is still present — without it there is nothing
+ *   - its `dispatch_payload` is still present (an in-process automation run
+ *     never had one and is declined as `not_redispatchable`, not as a loss)
+ *     — without it there is nothing
  *     to rehydrate the successor's request body from. Read HERE, before the
  *     caller's terminal write (which NULLs `dispatch_payload` on every other
  *     path), so it survives long enough to carry over.
@@ -1606,7 +1641,14 @@ async function attemptStaleRunRecovery(
   }
   const payload = row.dispatch_payload;
   if (typeof payload !== "string" || payload.length === 0) {
-    return { outcome: "payload_missing" };
+    // Not an anomaly, and specifically NOT a lost payload: every HTTP-dispatched
+    // background run writes `dispatch_payload` in the same INSERT that creates
+    // the row, so a payload-less row is one that was never HTTP-dispatched at
+    // all — an in-process automation from `runBackgroundAutomation`. It has no
+    // request body to rehydrate because there was never a request. Naming this
+    // `payload_missing` read as "we are losing payloads" in production
+    // forensics and sent a reader hunting a bug that does not exist.
+    return { outcome: "not_redispatchable" };
   }
   const threadId = row.thread_id;
   const turnId = row.turn_id ?? runId;

package/src/agent/thread-data-builder.ts

@@ -1,4 +1,8 @@
 import type { ActionChatUIConfig } from "../action-ui.js";
+import {
+  formatChatErrorText,
+  normalizeChatError,
+} from "../client/error-format.js";
 import {
   isCredentialGapCodeAgentEvent,
   normalizeCodeAgentTranscript,
@@ -140,12 +144,29 @@ export function buildAssistantMessage(
     }
   };
 
+  // Index of the last event that is not a `clear`. Everything after it is a
+  // trailing run of clears with no successor chunk to re-emit what they wipe.
+  let lastNonClearIndex = events.length - 1;
+  while (
+    lastNonClearIndex >= 0 &&
+    events[lastNonClearIndex]?.event.type === "clear"
+  ) {
+    lastNonClearIndex -= 1;
+  }
+
   for (const [index, { event }] of events.entries()) {
     if (event.type === "clear") {
       // A live stream always follows `clear` with the chunk that re-emits the
       // wiped content. A rebuild has no successor, so applying a TRAILING
       // clear can only destroy the transcript permanently.
-      if (index === events.length - 1) continue;
+      //
+      // The whole trailing RUN has to be skipped, not just the final element:
+      // each failed engine attempt emits one `clear`, so three failed attempts
+      // in a row is the common shape, and skipping only the last still applied
+      // the other two. When the run made no tool calls that emptied `content`
+      // entirely and this builder returned null — the user's message was left
+      // with no assistant reply at all.
+      if (index > lastNonClearIndex) continue;
       clearAssistantDraftContent(content);
       continue;
     }
@@ -248,13 +269,24 @@ export function buildAssistantMessage(
       if (event.errorCode === "run_timeout" && event.recoverable) {
         continue;
       }
+      // Mirror the live client (client/sse-event-processor.ts): route the raw
+      // provider/engine string through the same friendly-copy layer before it
+      // ever becomes persisted chat text, and keep the raw text only in
+      // `details`. Without this, a rebuild (background run, reconnect, poller,
+      // webhook turn) dumps whatever the provider sent — a JSON error body, an
+      // SSL handshake failure — straight into the user-visible transcript.
+      const normalized = normalizeChatError(event.error, event.errorCode);
       runError = {
-        message: event.error,
+        message: normalized.message,
         ...(event.errorCode ? { errorCode: event.errorCode } : {}),
-        ...(event.details ? { details: event.details } : {}),
+        ...((event.details ?? normalized.details)
+          ? { details: event.details ?? normalized.details }
+          : {}),
         ...(event.recoverable ? { recoverable: event.recoverable } : {}),
       };
-      appendText(`${content.length > 0 ? "\n\n" : ""}Error: ${event.error}`);
+      appendText(
+        `${content.length > 0 ? "\n\n" : ""}${formatChatErrorText(event.error, event.upgradeUrl, event.errorCode)}`,
+      );
       continue;
     }
 

package/src/cli/templates-meta.ts

@@ -254,6 +254,19 @@ export const TEMPLATES: TemplateMeta[] = [
     hidden: true,
     defaultMode: "dev",
   },
+  {
+    name: "factory",
+    label: "Factory",
+    hint: "Build agent factories with gates you control",
+    icon: "Users",
+    color: "#7C3AED",
+    colorRgb: "124 58 237",
+    devPort: 8108,
+    prodUrl: "https://agent-native-factory.netlify.app",
+    hidden: true,
+    defaultMode: "dev",
+    core: false,
+  },
 ];
 
 /** Return templates visible in user-facing pickers (excludes hidden). */

package/src/cli/workspace-dev.ts

@@ -712,6 +712,7 @@ export async function runWorkspaceDev(
         name: workspaceApp.name,
         description: workspaceApp.description,
         path: `/${workspaceApp.id}`,
+        port: workspaceApp.port,
         audience: workspaceApp.audience,
         publicPaths: workspaceApp.publicPaths,
         protectedPaths: workspaceApp.protectedPaths,

package/src/client/error-format.ts

@@ -95,6 +95,7 @@ function isProviderAuthenticationError(
     /\b(?:http\s*)?401\b.*\b(?:status|unauthorized|authentication|auth|no body)\b/i.test(
       text,
     ) ||
+    lower.includes("missing authentication header") ||
     lower.includes("invalid x-api-key") ||
     lower.includes("invalid api key") ||
     lower.includes("incorrect api key") ||
@@ -141,6 +142,17 @@ export function normalizeChatError(
     };
   }
 
+  // A model/parameter combination this provider will never accept. Retrying is
+  // pointless and the raw sentence names an API surface the reader has no way
+  // to act on, so say what they can actually change.
+  if (code === "provider_config_error") {
+    return {
+      message:
+        "This model can't use tools with the current settings. Switch models in Settings, then retry.",
+      details: text,
+    };
+  }
+
   if (isProviderRateLimit(text, errorCode)) {
     return {
       message:

package/src/credentials/index.ts

@@ -5,6 +5,7 @@ import {
   isEncryptedSecretValue,
 } from "../secrets/crypto.js";
 import { readAppSecret, type SecretRef } from "../secrets/storage.js";
+import { assertCredentialStoreReadable } from "../server/credential-provider.js";
 import { getSetting, putSetting, deleteSetting } from "../settings/store.js";
 
 const SETTING_PREFIX = "credential:";
@@ -76,6 +77,33 @@ export async function resolveCredentialForScope(
   return readCredentialSetting(userCredentialSettingKey(ctx.userEmail, key));
 }
 
+/**
+ * `ctx.orgId` when the caller supplied one, otherwise the org resolved from
+ * `ctx.userEmail`'s membership. Interactive requests always supply `orgId`
+ * (session/`getOrgContext` backfill it); CLI runs, cron jobs, and any other
+ * caller built straight from `getCredentialContext()` outside a request event
+ * do not, and previously fell through as "no active org" — invisibly skipping
+ * every org-scoped credential a signed-in session could see. Mirrors the
+ * fallback already proven in `resolveSecretDetailed`
+ * (server/credential-provider.ts).
+ */
+async function resolveEffectiveOrgId(
+  ctx: CredentialContext,
+): Promise<{ orgId: string | null; lookupFailed: boolean; cause?: unknown }> {
+  if (ctx.orgId) return { orgId: ctx.orgId, lookupFailed: false };
+  try {
+    const { resolveOrgIdForEmail } = await import("../org/context.js");
+    return {
+      orgId: await resolveOrgIdForEmail(ctx.userEmail),
+      lookupFailed: false,
+    };
+  } catch (cause) {
+    // Membership was unreadable, not merely absent — must not collapse to
+    // "caller has no org", which would silently hide every org-scoped row.
+    return { orgId: null, lookupFailed: true, cause };
+  }
+}
+
 /**
  * Resolve a credential across the encrypted app_secrets store and the legacy
  * settings-backed credential store. User overrides win, followed by the
@@ -92,7 +120,12 @@ export async function resolveCredentialForScope(
  *   5. org-scoped legacy settings credential
  *   6. solo workspace-scoped app_secrets (`solo:<email>`)
  *
- * Steps 3-5 are skipped without an active org.
+ * Steps 3-5 use `ctx.orgId` when given, else the org resolved from
+ * `ctx.userEmail` (see `resolveEffectiveOrgId`), and are skipped only when the
+ * caller truly has no org. A membership lookup that could not be read throws
+ * `CredentialStoreUnavailableError` instead of silently reporting the
+ * credential as unset — "the store didn't answer" and "nothing is saved" are
+ * different outcomes callers must not conflate.
  */
 export async function resolveCredential(
   key: string,
@@ -109,19 +142,20 @@ export async function resolveCredential(
   });
   if (userSetting) return userSetting;
 
-  if (ctx.orgId) {
-    const orgSecret = await readScopedAppSecret(key, "org", ctx.orgId);
+  const orgLookup = await resolveEffectiveOrgId(ctx);
+  assertCredentialStoreReadable(orgLookup);
+  const { orgId } = orgLookup;
+
+  if (orgId) {
+    const orgSecret = await readScopedAppSecret(key, "org", orgId);
     if (orgSecret) return orgSecret;
 
-    const workspaceSecret = await readScopedAppSecret(
-      key,
-      "workspace",
-      ctx.orgId,
-    );
+    const workspaceSecret = await readScopedAppSecret(key, "workspace", orgId);
     if (workspaceSecret) return workspaceSecret;
 
     const orgSetting = await resolveCredentialForScope(key, {
       ...ctx,
+      orgId,
       scope: "org",
     });
     if (orgSetting) return orgSetting;
@@ -156,7 +190,9 @@ export async function resolveCredential(
  * org the caller already belongs to), and never return the owning account, how
  * many rows matched, or any part of the value. Without an active org there is
  * no boundary to bound the probe to, so it declines to answer rather than
- * revealing that some other tenant holds a key of the same name.
+ * revealing that some other tenant holds a key of the same name — this
+ * includes callers whose `ctx.orgId` is unset AND whose org could not be
+ * resolved from `ctx.userEmail` (see `resolveEffectiveOrgId`).
  *
  * Returns null when nothing safe and useful can be said.
  */
@@ -164,10 +200,13 @@ export async function describeCredentialScopeGap(
   keys: readonly string[],
   ctx: CredentialContext,
 ): Promise<string | null> {
-  if (!ctx?.userEmail || !ctx.orgId) return null;
+  if (!ctx?.userEmail) return null;
+  const orgLookup = await resolveEffectiveOrgId(ctx);
+  if (orgLookup.lookupFailed || !orgLookup.orgId) return null;
+  const scopedCtx: CredentialContext = { ...ctx, orgId: orgLookup.orgId };
 
   for (const key of keys) {
-    if (await hasForeignPersonalCredentialInOrg(key, ctx)) {
+    if (await hasForeignPersonalCredentialInOrg(key, scopedCtx)) {
       return (
         `A "${key}" key is saved in this workspace with Personal scope. ` +
         `Personal keys are readable only by their own owner's signed-in sessions, ` +
@@ -177,7 +216,7 @@ export async function describeCredentialScopeGap(
       );
     }
 
-    const holder = await findMemberOrgHoldingCredential(key, ctx);
+    const holder = await findMemberOrgHoldingCredential(key, scopedCtx);
     if (holder) {
       return (
         `A "${key}" key is saved in the ${holder} organization, but this ` +

package/src/extensions/url-safety.ts

@@ -167,6 +167,21 @@ function normalizeLookupHostname(hostname: string): string {
   return hostname.toLowerCase().replace(/^\[|\]$/g, "");
 }
 
+function loopbackHostnameVariants(hostname: string): string[] {
+  const normalized = normalizeLookupHostname(hostname);
+  if (
+    normalized !== "localhost" &&
+    normalized !== "127.0.0.1" &&
+    normalized !== "::1"
+  ) {
+    return [normalized];
+  }
+  // Local workspace manifests can identify the same child server as
+  // localhost, 127.0.0.1, or ::1. They are equivalent only for loopback; do
+  // not alias arbitrary private or public hostnames.
+  return ["localhost", "127.0.0.1", "::1"];
+}
+
 function normalizeAllowedPrivateOriginKeys(
   origins: readonly string[],
 ): Set<string> {
@@ -178,7 +193,30 @@ function normalizeAllowedPrivateOriginKeys(
         continue;
       }
       const port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
-      keys.add(`${normalizeLookupHostname(parsed.hostname)}:${port}`);
+      for (const hostname of loopbackHostnameVariants(parsed.hostname)) {
+        keys.add(`${hostname}:${port}`);
+      }
+    } catch {
+      // coercion-ok: malformed deployment configuration is omitted, preserving the fail-closed private-IP guard.
+    }
+  }
+  return keys;
+}
+
+function normalizeAllowedPrivateOriginOriginKeys(
+  origins: readonly string[],
+): Set<string> {
+  const keys = new Set<string>();
+  for (const origin of origins) {
+    try {
+      const parsed = new URL(origin);
+      if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        continue;
+      }
+      const port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
+      for (const hostname of loopbackHostnameVariants(parsed.hostname)) {
+        keys.add(`${parsed.protocol}//${hostname}:${port}`);
+      }
     } catch {
       // Ignore malformed deployment configuration and retain the private-IP guard.
     }
@@ -309,21 +347,17 @@ export async function ssrfSafeFetch(
   const dispatcher =
     (await createSsrfSafeDispatcher(options.allowedPrivateOrigins)) ??
     undefined;
-  const allowedPrivateOrigins = new Set(
-    (options.allowedPrivateOrigins ?? [])
-      .map((origin) => {
-        try {
-          return new URL(origin).origin;
-        } catch {
-          return "";
-        }
-      })
-      .filter(Boolean),
+  const allowedPrivateOrigins = normalizeAllowedPrivateOriginOriginKeys(
+    options.allowedPrivateOrigins ?? [],
   );
   const isAllowedPrivateOrigin = (candidate: string): boolean => {
     if (allowedPrivateOrigins.size === 0) return false;
     try {
-      return allowedPrivateOrigins.has(new URL(candidate).origin);
+      const parsed = new URL(candidate);
+      const port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
+      return allowedPrivateOrigins.has(
+        `${parsed.protocol}//${normalizeLookupHostname(parsed.hostname)}:${port}`,
+      );
     } catch {
       return false;
     }

package/src/integrations/adapters/slack.ts

@@ -11,7 +11,7 @@ import { consumeIntegrationAwaitingInput } from "../awaiting-input-store.js";
 import { createIntegrationControl } from "../controls-store.js";
 import {
   getActiveIntegrationInstallationByKey,
-  getActiveIntegrationInstallationForTenant,
+  listActiveIntegrationInstallationsForTenant,
   listIntegrationInstallations,
   resolveIntegrationTokenBundle,
 } from "../installations-store.js";
@@ -666,13 +666,18 @@ export function slackAdapter(
           channelId: target.destination,
           threadTs: target.threadRef,
           teamId: target.tenantId,
+          installationKey: target.installationKey,
         },
         tenantId: target.tenantId,
         timestamp: Date.now(),
       };
       const token = await resolveBotToken(targetContext);
       if (!token) {
-        console.error("[slack] SLACK_BOT_TOKEN not configured");
+        console.error(
+          "[slack] no bot token for outbound target" +
+            (target.tenantId ? ` (tenant ${target.tenantId})` : "") +
+            "; set SLACK_BOT_TOKEN or pass installationKey to name the app",
+        );
         return;
       }
 
@@ -808,25 +813,42 @@ async function resolveManagedSlackBotToken(
     typeof incoming.platformContext.enterpriseId === "string"
       ? incoming.platformContext.enterpriseId
       : undefined;
+  const installationKeyHint =
+    typeof incoming.platformContext.installationKey === "string"
+      ? incoming.platformContext.installationKey
+      : undefined;
   if (!teamId && !enterpriseId) return undefined;
   try {
-    let installation = apiAppId
+    let installation = installationKeyHint
       ? await getActiveIntegrationInstallationByKey(
           "slack",
-          slackInstallationKey({ teamId, enterpriseId, apiAppId }),
+          installationKeyHint,
         )
       : null;
-    if (!installation && !apiAppId && teamId) {
-      installation = await getActiveIntegrationInstallationForTenant(
+    if (!installation && apiAppId) {
+      installation = await getActiveIntegrationInstallationByKey(
         "slack",
-        teamId,
+        slackInstallationKey({ teamId, enterpriseId, apiAppId }),
       );
     }
-    if (!installation && !apiAppId && enterpriseId) {
-      installation = await getActiveIntegrationInstallationForTenant(
+    if (!installation && !apiAppId) {
+      // Without an app id the tenant can match several connected Slack apps.
+      // Sending as an arbitrary one posts under the wrong bot identity, so
+      // only proceed when the tenant resolves to exactly one installation.
+      const tenant = teamId ?? enterpriseId!;
+      const candidates = await listActiveIntegrationInstallationsForTenant(
         "slack",
-        enterpriseId,
+        tenant,
       );
+      if (candidates.length > 1) {
+        console.error(
+          `[slack] ${candidates.length} connected Slack apps for tenant ${tenant}; ` +
+            `cannot choose one without an app id. Pass installationKey on the outbound target. ` +
+            `Candidates: ${candidates.map((c) => c.installationKey).join(", ")}`,
+        );
+        return undefined;
+      }
+      installation = candidates[0] ?? null;
     }
     const key =
       installation?.installationKey ??

package/src/integrations/google-docs-poller.ts

@@ -1,3 +1,4 @@
+import { isInBackgroundFunctionRuntime } from "../agent/durable-background.js";
 import { createAnthropicEngine } from "../agent/engine/index.js";
 import type { EngineMessage } from "../agent/engine/types.js";
 import {
@@ -518,7 +519,17 @@ async function processComment(
               signal,
             },
             undefined,
-            { useHostedDefault: true },
+            // Same omission the scheduled-job runner had: without this, a
+            // poller-driven reply inherits the interactive clamp (40s soft
+            // timeout, a no-progress backstop at 0.75x that, 6 continuations)
+            // even though no client is waiting on a response. Uses the runtime
+            // check rather than a hardcoded `true` — matching webhook-handler.ts
+            // in this same subsystem — because unlike the job runner there is no
+            // hard-abort cap here to bound a wider ceiling.
+            {
+              useHostedDefault: true,
+              backgroundFunction: isInBackgroundFunctionRuntime(),
+            },
           ),
       );
     },