@agent-native/core 0.136.3 → 0.136.5

package/corpus/templates/clips/server/lib/post-finalize-dispatch.ts

@@ -78,6 +78,12 @@ export async function dispatchPostFinalizeJob(args: {
         }
       : {}),
   });
+  console.log("[post-finalize] dispatching", {
+    recordingId: args.recordingId,
+    kind: args.kind,
+    workerUrl,
+    usesDurableBackground,
+  });
   const post = (url: string) =>
     fetch(url, {
       method: "POST",
@@ -89,7 +95,14 @@ export async function dispatchPostFinalizeJob(args: {
       usesDurableBackground && !initialResponse.ok
         ? await post(resolveWorkerUrl(processorRoute))
         : initialResponse;
-    if (response.ok) return;
+    if (response.ok) {
+      console.log("[post-finalize] dispatch accepted", {
+        recordingId: args.recordingId,
+        kind: args.kind,
+        status: response.status,
+      });
+      return;
+    }
     const detail = (await response.text().catch(() => "")).trim().slice(0, 300);
     throw new Error(
       `Post-finalize ${args.kind} worker returned HTTP ${response.status}${

package/corpus/templates/clips/server/plugins/auth.ts

@@ -45,6 +45,15 @@ export default createAuthPlugin({
     "/api/video",
     "/api/thumbnail",
     "/api/auth/google-calendar",
+    // Internal post-finalize worker (media verification, seekable remux,
+    // transcript, brain-export, loom-import retries). It's a server-to-server
+    // self-dispatch with no session cookie — its own scoped, short-lived
+    // signed token (verifyScopedAgentAccessToken) is the real auth check, so
+    // it must bypass the session gate to ever reach that check. Exact path
+    // only, not the whole `_agent-native-background` namespace — a future
+    // route added under that prefix without its own auth check must not
+    // become silently public by inheriting this bypass.
+    "/api/_agent-native-background/post-finalize-worker",
     "/_agent-native/google/auth-url",
     "/_agent-native/google/callback",
   ],

package/corpus/templates/clips/server/routes/api/_agent-native-background/post-finalize-worker.post.ts

@@ -51,11 +51,17 @@ export default defineEventHandler(async (event: H3Event) => {
 
   const { recordingId, kind, token, delayMs, retryAttempt, regenerate } =
     parsed.data;
+  console.log("[post-finalize-worker] received job", { recordingId, kind });
   const verified = verifyScopedAgentAccessToken(token, {
     resourceKind: POST_FINALIZE_JOB_TOKEN_KIND,
     resourceId: postFinalizeJobResourceId(recordingId, kind),
   });
   if (!verified.ok) {
+    console.warn("[post-finalize-worker] token verification failed", {
+      recordingId,
+      kind,
+      reason: verified.reason,
+    });
     setResponseStatus(event, 401);
     return { ok: false, error: "Invalid or expired post-finalize job token" };
   }
@@ -153,6 +159,9 @@ export default defineEventHandler(async (event: H3Event) => {
           )
           .returning({ id: schema.recordings.id });
         if (!claimed) {
+          console.log("[post-finalize-worker] loom-import already running", {
+            recordingId,
+          });
           return {
             ok: true,
             recordingId,
@@ -161,6 +170,10 @@ export default defineEventHandler(async (event: H3Event) => {
             reason: "loom-import-already-running",
           };
         }
+        console.log("[post-finalize-worker] loom-import claimed", {
+          recordingId,
+          claimId,
+        });
         const result = await runLoomImportJob({
           recordingId,
           ownerEmail: recording.ownerEmail,

package/dist/client/agent-page/AgentJobsTab.js

@@ -10,7 +10,7 @@ import { AgentEmptyState } from "./AgentEmptyState.js";
 import { AgentTabFrame } from "./AgentTabFrame.js";
 import { AutomationDetailsDialog, } from "./AutomationDetailsDialog.js";
 import { AutomationScheduleDialog } from "./AutomationScheduleDialog.js";
-import { useAutomations, useManageAutomation, useManageRecurringJob, useRecurringJobs, } from "./use-jobs.js";
+import { useAutomations, useManageAutomation, useManageRecurringJob, useRunAutomationNow, useRecurringJobs, } from "./use-jobs.js";
 function listRecurringJobs(jobs) {
     return jobs.map((resource) => ({
         kind: "recurring",
@@ -107,9 +107,11 @@ export function AgentJobsTab({ canManageOrg = false }) {
     const personalAutomationsMutation = useManageAutomation("user");
     const organizationJobsMutation = useManageRecurringJob("org");
     const organizationAutomationsMutation = useManageAutomation("org");
+    const runAutomationMutation = useRunAutomationNow();
     const [deleteTarget, setDeleteTarget] = useState(null);
     const [detailsTarget, setDetailsTarget] = useState(null);
     const [scheduleTarget, setScheduleTarget] = useState(null);
+    const [runTarget, setRunTarget] = useState(null);
     const formatDateTime = (value) => {
         if (!value || Number.isNaN(new Date(value).getTime()))
             return null;
@@ -210,7 +212,7 @@ export function AgentJobsTab({ canManageOrg = false }) {
                                                         : t("jobs.paused", { defaultValue: "Paused" }) }), resource.lastStatus ? (_jsx("span", { className: "rounded-full bg-muted px-2 py-0.5 text-[10px] font-medium text-muted-foreground", children: resource.lastStatus })) : null] }), _jsx("p", { className: "mt-1 text-sm text-muted-foreground", children: triggerDescription }), _jsx("p", { className: "mt-1 line-clamp-2 text-xs text-muted-foreground/80", children: instructions }), lastRun || nextRun || lastCheck ? (_jsxs("div", { className: "mt-2 flex flex-wrap gap-x-4 gap-y-1 text-[11px] text-muted-foreground", children: [nextRun ? (_jsxs("span", { children: [t("jobs.nextRun", { defaultValue: "Next run" }), ":", " ", nextRun] })) : null, _jsxs("span", { children: [t("jobs.lastRun", { defaultValue: "Last run" }), ":", " ", lastRun ??
                                                             t("jobs.neverRan", { defaultValue: "Never" })] }), !lastRun && lastCheck ? (_jsxs("span", { children: [t("jobs.lastChecked", {
                                                             defaultValue: "Last checked",
-                                                        }), ": ", lastCheck] })) : null] })) : null, resource.lastError ? (_jsxs("p", { className: "mt-2 flex items-start gap-1.5 text-[11px] text-destructive", children: [_jsx(IconAlertTriangle, { className: "mt-px size-3 shrink-0" }), _jsx("span", { className: "min-w-0 break-words", children: resource.lastError })] })) : null] }), _jsxs("div", { className: "flex shrink-0 items-center gap-1", children: [_jsxs(Button, { type: "button", variant: "ghost", size: "sm", className: "cursor-pointer px-2 text-xs", onClick: () => setDetailsTarget(entry), children: [_jsx(IconEye, { className: "size-3.5" }), t("jobs.details", { defaultValue: "Details" })] }), resource.canUpdate ? (_jsxs(_Fragment, { children: [entry.triggerType === "schedule" ? (_jsxs(Button, { type: "button", variant: "ghost", size: "sm", className: "cursor-pointer px-2 text-xs", disabled: mutationPending, onClick: () => setScheduleTarget(entry), children: [_jsx(IconPencil, { className: "size-3.5" }), t("jobs.edit", { defaultValue: "Edit" })] })) : null, _jsxs(Button, { type: "button", variant: "ghost", size: "sm", className: "cursor-pointer px-2 text-xs", disabled: mutationPending, onClick: () => mutateEntry(entry, "update", {
+                                                        }), ": ", lastCheck] })) : null] })) : null, resource.lastError ? (_jsxs("p", { className: "mt-2 flex items-start gap-1.5 text-[11px] text-destructive", children: [_jsx(IconAlertTriangle, { className: "mt-px size-3 shrink-0" }), _jsx("span", { className: "min-w-0 break-words", children: resource.lastError })] })) : null] }), _jsxs("div", { className: "flex shrink-0 items-center gap-1", children: [_jsxs(Button, { type: "button", variant: "ghost", size: "sm", className: "cursor-pointer px-2 text-xs", onClick: () => setDetailsTarget(entry), children: [_jsx(IconEye, { className: "size-3.5" }), t("jobs.details", { defaultValue: "Details" })] }), resource.canUpdate ? (_jsxs(_Fragment, { children: [_jsxs(Button, { type: "button", variant: "ghost", size: "sm", className: "cursor-pointer px-2 text-xs", disabled: mutationPending || runAutomationMutation.isPending, onClick: () => setRunTarget(entry), children: [_jsx(IconPlayerPlay, { className: "size-3.5" }), t("jobs.runNow", { defaultValue: "Run now" })] }), entry.triggerType === "schedule" ? (_jsxs(Button, { type: "button", variant: "ghost", size: "sm", className: "cursor-pointer px-2 text-xs", disabled: mutationPending, onClick: () => setScheduleTarget(entry), children: [_jsx(IconPencil, { className: "size-3.5" }), t("jobs.edit", { defaultValue: "Edit" })] })) : null, _jsxs(Button, { type: "button", variant: "ghost", size: "sm", className: "cursor-pointer px-2 text-xs", disabled: mutationPending, onClick: () => mutateEntry(entry, "update", {
                                                         enabled: !resource.enabled,
                                                     }), children: [resource.enabled ? (_jsx(IconPlayerPause, { className: "size-3.5" })) : (_jsx(IconPlayerPlay, { className: "size-3.5" })), resource.enabled
                                                             ? t("jobs.pause", { defaultValue: "Pause" })
@@ -221,7 +223,8 @@ export function AgentJobsTab({ canManageOrg = false }) {
     const mutationError = personalJobsMutation.error ||
         personalAutomationsMutation.error ||
         organizationJobsMutation.error ||
-        organizationAutomationsMutation.error;
+        organizationAutomationsMutation.error ||
+        runAutomationMutation.error;
     return (_jsxs(AgentTabFrame, { title: t("jobs.pageTitle", { defaultValue: "Automations" }), description: t("jobs.pageDescription", {
             defaultValue: "Manage agent tasks that run on a schedule or in response to events.",
         }), actions: _jsx(AgentAskPopover, { context: automationCreationContext(), prompt: t("jobs.automationPrompt", {
@@ -268,7 +271,19 @@ export function AgentJobsTab({ canManageOrg = false }) {
                                         if (!deleteTarget)
                                             return;
                                         mutateEntry(deleteTarget, "delete", undefined, () => setDeleteTarget(null));
-                                    }, children: [mutationPending ? (_jsx(IconLoader2, { className: "size-4 animate-spin" })) : null, t("jobs.delete", { defaultValue: "Delete" })] })] })] }) }), detailsTarget ? (_jsx(AutomationDetailsDialog, { open: true, name: detailsTarget.resource.name, scope: detailsTarget.resource.scope === "organization" ? "org" : "user", triggerSummary: describeTrigger(detailsTarget, t), fields: detailsFields(detailsTarget, t, formatDateTime), condition: detailsTarget.kind === "automation"
+                                    }, children: [mutationPending ? (_jsx(IconLoader2, { className: "size-4 animate-spin" })) : null, t("jobs.delete", { defaultValue: "Delete" })] })] })] }) }), _jsx(Dialog, { open: runTarget !== null, onOpenChange: (open) => {
+                    if (!open && !runAutomationMutation.isPending)
+                        setRunTarget(null);
+                }, children: _jsxs(DialogContent, { children: [_jsxs(DialogHeader, { children: [_jsx(DialogTitle, { children: t("jobs.runNowTitle", { defaultValue: "Run automation now?" }) }), _jsx(DialogDescription, { children: t("jobs.runNowDescription", {
+                                        defaultValue: "This runs the automation's real actions immediately. It may send messages or change data, and it will not change the next scheduled run.",
+                                    }) })] }), runAutomationMutation.error ? (_jsx("p", { className: "text-sm text-destructive", children: runAutomationMutation.error.message })) : null, _jsxs(DialogFooter, { children: [_jsx(Button, { type: "button", variant: "outline", className: "cursor-pointer", disabled: runAutomationMutation.isPending, onClick: () => setRunTarget(null), children: t("jobs.cancel", { defaultValue: "Cancel" }) }), _jsxs(Button, { type: "button", className: "cursor-pointer", disabled: runAutomationMutation.isPending, onClick: () => {
+                                        if (!runTarget)
+                                            return;
+                                        runAutomationMutation.mutate({
+                                            name: runTarget.resource.name,
+                                            scope: runTarget.resource.scope,
+                                        }, { onSuccess: () => setRunTarget(null) });
+                                    }, children: [runAutomationMutation.isPending ? (_jsx(IconLoader2, { className: "size-4 animate-spin" })) : (_jsx(IconPlayerPlay, { className: "size-4" })), t("jobs.runNow", { defaultValue: "Run now" })] })] })] }) }), detailsTarget ? (_jsx(AutomationDetailsDialog, { open: true, name: detailsTarget.resource.name, scope: detailsTarget.resource.scope === "organization" ? "org" : "user", triggerSummary: describeTrigger(detailsTarget, t), fields: detailsFields(detailsTarget, t, formatDateTime), condition: detailsTarget.kind === "automation"
                     ? detailsTarget.resource.condition
                     : null, instructions: detailsTarget.kind === "automation"
                     ? detailsTarget.resource.body

package/dist/client/agent-page/use-jobs.d.ts

@@ -55,6 +55,15 @@ export type ManageJobInput = {
     timezone?: string;
 };
 export type ManageAutomationInput = ManageJobInput;
+export interface RunAutomationNowInput {
+    name: string;
+    scope: "personal" | "organization";
+}
+export interface RunAutomationNowResult {
+    queued: true;
+    runId: string;
+    automationRunId: string;
+}
 export interface AutomationRun {
     id: string;
     automation: string;
@@ -78,5 +87,6 @@ export declare function useManageAutomation(scope: JobsScope): import("@tanstack
     name: string;
     enabled?: boolean;
 }, Error, ManageJobInput, unknown>;
+export declare function useRunAutomationNow(): import("@tanstack/react-query").UseMutationResult<RunAutomationNowResult, Error, RunAutomationNowInput, unknown>;
 export declare function useAutomationRuns(scope: JobsScope, name: string | null, active: boolean): import("@tanstack/react-query").UseQueryResult<NoInfer<AutomationRun[]>, Error>;
 //# sourceMappingURL=use-jobs.d.ts.map

package/dist/client/agent-page/use-jobs.js

@@ -68,6 +68,27 @@ export function useManageAutomation(scope) {
         },
     });
 }
+export function useRunAutomationNow() {
+    const queryClient = useQueryClient();
+    return useActionMutation("run-automation-now", {
+        onSuccess: (_result, variables) => {
+            const scope = variables.scope === "organization" ? "organization" : "personal";
+            queryClient.invalidateQueries({
+                queryKey: [
+                    "action",
+                    "list-automation-runs",
+                    { scope, name: variables.name },
+                ],
+            });
+            queryClient.invalidateQueries({
+                queryKey: ["action", "list-automations", { scope }],
+            });
+            queryClient.invalidateQueries({
+                queryKey: ["action", "list-recurring-jobs", { scope }],
+            });
+        },
+    });
+}
 function optimisticPatch(variables) {
     const patch = {};
     if (variables.enabled !== undefined)

package/dist/client/settings/SecretsSection.js

@@ -98,16 +98,23 @@ function KeysHeader({ availableSecrets = [], onSecret, onCustomKey, }) {
                                                 }, children: [_jsx(IconPlus, { size: 14 }), "Custom"] }) })] })] }) })] })] }));
 }
 function SecretCard({ secret, onChanged, open, onOpenChange, focusInput, }) {
+    const t = useT();
     const [value, setValue] = useState("");
+    const [isRotating, setIsRotating] = useState(false);
     const [busy, setBusy] = useState(null);
     const [confirmDelete, setConfirmDelete] = useState(false);
     const [toast, setToast] = useState(null);
     const inputRef = React.useRef(null);
     useEffect(() => {
-        if (open && focusInput && inputRef.current) {
+        if (!open) {
+            setValue("");
+            setIsRotating(false);
+            return;
+        }
+        if ((focusInput || isRotating) && inputRef.current) {
             inputRef.current.focus();
         }
-    }, [focusInput, open]);
+    }, [focusInput, isRotating, open]);
     const setToastAndClear = (kind, text, ms = 2500) => {
         setToast({ kind, text });
         setTimeout(() => setToast(null), ms);
@@ -131,6 +138,7 @@ function SecretCard({ secret, onChanged, open, onOpenChange, focusInput, }) {
                 return;
             }
             setValue("");
+            setIsRotating(false);
             setConfirmDelete(false);
             setToastAndClear("ok", "Saved");
             notifySecretsChanged();
@@ -166,20 +174,32 @@ function SecretCard({ secret, onChanged, open, onOpenChange, focusInput, }) {
             setBusy(null);
         }
     };
-    const handleTest = async () => {
+    const handleTest = async (candidateValue) => {
         if (busy)
             return;
-        setBusy("test");
+        const isCandidate = candidateValue !== undefined;
+        setBusy(isCandidate ? "test-candidate" : "test");
         try {
             const res = await fetch(`${ENDPOINT}/${encodeURIComponent(secret.key)}/test`, {
                 method: "POST",
+                ...(isCandidate
+                    ? {
+                        headers: { "Content-Type": "application/json" },
+                        body: JSON.stringify({ value: candidateValue }),
+                    }
+                    : {}),
             });
             const body = (await res.json().catch(() => ({})));
             if (res.ok && body.ok) {
-                setToastAndClear("ok", "Working");
+                setToastAndClear("ok", isCandidate
+                    ? t("secrets.candidateValueWorking")
+                    : t("secrets.storedValueWorking"));
             }
             else {
-                setToastAndClear("err", body.error ?? (body.ok === false ? "Invalid" : `Test failed`));
+                setToastAndClear("err", body.error ??
+                    (body.ok === false
+                        ? t("secrets.invalid")
+                        : t("secrets.testFailed")));
             }
         }
         finally {
@@ -196,12 +216,16 @@ function SecretCard({ secret, onChanged, open, onOpenChange, focusInput, }) {
         return (_jsx("span", { className: "rounded-full bg-accent/60 px-1.5 py-0.5 text-[9px] font-semibold uppercase tracking-wide text-muted-foreground", children: "Optional" }));
     }, [secret.status, secret.required]);
     const isOAuth = secret.kind === "oauth";
-    return (_jsxs("div", { className: "border-b border-border last:border-b-0", children: [_jsxs(Button, { type: "button", intent: "neutral", emphasis: "ghost", "aria-expanded": open, onClick: () => onOpenChange(!open), className: "flex w-full items-center gap-2 px-2.5 py-2 text-start transition-colors hover:bg-accent/30", children: [_jsx(IconChevronRight, { size: 13, className: `shrink-0 text-muted-foreground transition-transform ${open ? "rotate-90" : ""}` }), _jsx("span", { className: "min-w-0 flex-1 truncate text-[11px] font-medium text-foreground", children: secret.label }), secret.status === "set" && secret.last4 && (_jsxs("code", { className: "text-[10px] text-muted-foreground", children: ["\u2022\u2022\u2022\u2022", secret.last4] })), _jsx("span", { className: "shrink-0", children: pill })] }), open && (_jsxs("div", { className: "border-t border-border/60 bg-accent/20 px-3 pb-3 pt-2.5", children: [secret.description && (_jsx("p", { className: "mb-2 text-[10px] leading-relaxed text-muted-foreground", children: secret.description })), isOAuth ? (_jsxs("div", { className: "mt-2 flex items-center gap-1.5", children: [secret.oauthConnectUrl && (_jsxs("a", { href: secret.oauthConnectUrl, className: "inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] font-medium no-underline", style: { backgroundColor: "#00B5FF", color: "white" }, children: [_jsx(IconPlugConnected, { size: 10 }), secret.status === "set" ? "Reconnect" : "Connect"] })), secret.docsUrl && (_jsxs("a", { href: secret.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] no-underline text-muted-foreground hover:text-foreground", children: ["Docs", _jsx(IconExternalLink, { size: 10 })] }))] })) : (_jsxs("div", { className: "mt-2 space-y-1.5", children: [secret.status === "set" && (_jsxs("div", { className: "flex items-center gap-2 text-[10px] text-muted-foreground", children: [_jsx("span", { children: "Stored value ending in" }), _jsx("code", { className: "rounded bg-background px-1 py-0.5 text-foreground", children: secret.last4 })] })), _jsxs("div", { className: "flex gap-1.5", children: [_jsx(TextField, { inputRef: inputRef, type: "password", "aria-label": secret.label, value: value, onChange: setValue, onKeyDown: (event) => {
+    const showRotationForm = secret.status !== "set" || isRotating;
+    return (_jsxs("div", { className: "border-b border-border last:border-b-0", children: [_jsxs(Button, { type: "button", intent: "neutral", emphasis: "ghost", "aria-expanded": open, onClick: () => onOpenChange(!open), className: "flex w-full items-center gap-2 px-2.5 py-2 text-start transition-colors hover:bg-accent/30", children: [_jsx(IconChevronRight, { size: 13, className: `shrink-0 text-muted-foreground transition-transform ${open ? "rotate-90" : ""}` }), _jsx("span", { className: "min-w-0 flex-1 truncate text-[11px] font-medium text-foreground", children: secret.label }), secret.status === "set" && secret.last4 && (_jsxs("code", { className: "text-[10px] text-muted-foreground", children: ["\u2022\u2022\u2022\u2022", secret.last4] })), _jsx("span", { className: "shrink-0", children: pill })] }), open && (_jsxs("div", { className: "border-t border-border/60 bg-accent/20 px-3 pb-3 pt-2.5", children: [secret.description && (_jsx("p", { className: "mb-2 text-[10px] leading-relaxed text-muted-foreground", children: secret.description })), isOAuth ? (_jsxs("div", { className: "mt-2 flex items-center gap-1.5", children: [secret.oauthConnectUrl && (_jsxs("a", { href: secret.oauthConnectUrl, className: "inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] font-medium no-underline", style: { backgroundColor: "#00B5FF", color: "white" }, children: [_jsx(IconPlugConnected, { size: 10 }), secret.status === "set" ? "Reconnect" : "Connect"] })), secret.docsUrl && (_jsxs("a", { href: secret.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] no-underline text-muted-foreground hover:text-foreground", children: ["Docs", _jsx(IconExternalLink, { size: 10 })] }))] })) : (_jsxs("div", { className: "mt-2 space-y-2", children: [secret.status === "set" && (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex items-center gap-2 text-[10px] text-muted-foreground", children: [_jsx("span", { children: "Stored value ending in" }), _jsx("code", { className: "mt-1 block w-fit rounded bg-background px-1 py-0.5 text-foreground", children: secret.last4 })] }), _jsxs("div", { className: "flex flex-wrap items-center gap-1.5", children: [_jsx(Button, { type: "button", intent: "neutral", emphasis: "outline", onClick: () => handleTest(), disabled: busy !== null, className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] text-muted-foreground hover:text-foreground disabled:opacity-40", children: busy === "test" ? (_jsx(IconLoader2, { size: 10, className: "animate-spin" })) : (t("secrets.testStoredValue")) }), _jsxs(Button, { type: "button", intent: "primary", emphasis: "solid", onClick: () => setIsRotating(true), disabled: busy !== null, className: "inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] font-medium disabled:opacity-40", style: { backgroundColor: "#00B5FF", color: "white" }, children: [_jsx(IconRefresh, { size: 10 }), "Rotate"] }), _jsxs(Button, { type: "button", intent: "danger", emphasis: "outline", onClick: () => setConfirmDelete(true), disabled: busy !== null, className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] text-muted-foreground hover:text-red-500 disabled:opacity-40", children: [_jsx(IconTrash, { size: 10 }), "Delete"] })] })] })), showRotationForm && (_jsxs("div", { className: "space-y-1.5", children: [_jsx("hr", { className: "my-4" }), _jsx(TextField, { inputRef: inputRef, type: "password", "aria-label": secret.label, value: value, onChange: setValue, onKeyDown: (event) => {
                                             if (event.key === "Enter")
                                                 handleSave();
                                         }, placeholder: secret.status === "set"
                                             ? "Enter new value to rotate"
-                                            : "Paste key", className: "flex-1 text-[11px]" }), _jsx(Button, { type: "button", intent: "primary", emphasis: "solid", onClick: handleSave, disabled: !value.trim() || busy !== null, className: "inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] font-medium disabled:opacity-40", style: { backgroundColor: "#00B5FF", color: "white" }, children: busy === "save" ? (_jsx(IconLoader2, { size: 10, className: "animate-spin" })) : secret.status === "set" ? (_jsxs(_Fragment, { children: [_jsx(IconRefresh, { size: 10 }), "Rotate"] })) : ("Save") })] }), _jsxs("div", { className: "flex items-center gap-1.5", children: [secret.status === "set" && (_jsxs(_Fragment, { children: [_jsx(Button, { type: "button", intent: "neutral", emphasis: "outline", onClick: handleTest, disabled: busy !== null, className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] text-muted-foreground hover:text-foreground disabled:opacity-40", children: busy === "test" ? (_jsx(IconLoader2, { size: 10, className: "animate-spin" })) : ("Test") }), _jsxs(Button, { type: "button", intent: "danger", emphasis: "outline", onClick: () => setConfirmDelete(true), disabled: busy !== null, className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] text-muted-foreground hover:text-red-500 disabled:opacity-40", children: [_jsx(IconTrash, { size: 10 }), "Remove"] })] })), secret.docsUrl && (_jsxs("a", { href: secret.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] no-underline text-muted-foreground hover:text-foreground ms-auto", children: ["Get key", _jsx(IconExternalLink, { size: 10 })] }))] }), confirmDelete && (_jsxs("div", { className: "flex items-center gap-1.5 rounded border border-red-500/30 bg-red-500/10 px-2 py-1.5 text-[10px] text-red-500", children: [_jsx("span", { className: "min-w-0 flex-1", children: "Remove this saved value?" }), _jsx(Button, { type: "button", intent: "danger", emphasis: "solid", onClick: handleDelete, disabled: busy !== null, className: "inline-flex items-center gap-1 rounded border border-red-500/40 px-1.5 py-0.5 font-medium disabled:opacity-40", children: busy === "delete" ? (_jsx(IconLoader2, { size: 10, className: "animate-spin" })) : ("Confirm") }), _jsx(Button, { type: "button", intent: "neutral", emphasis: "outline", onClick: () => setConfirmDelete(false), disabled: busy !== null, className: "rounded border border-border px-1.5 py-0.5 text-muted-foreground hover:text-foreground disabled:opacity-40", children: "Cancel" })] }))] })), toast && (_jsx("p", { className: `mt-1.5 text-[10px] ${toast.kind === "ok" ? "text-green-500" : "text-red-500"}`, children: toast.text }))] }))] }));
+                                            : "Paste key", className: "w-full text-[11px]" }), _jsxs("div", { className: "flex flex-wrap items-center gap-1.5", children: [_jsx(Button, { type: "button", intent: "neutral", emphasis: "outline", onClick: () => handleTest(value.trim()), disabled: !value.trim() || busy !== null, className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] text-muted-foreground hover:text-foreground disabled:opacity-40", children: busy === "test-candidate" ? (_jsx(IconLoader2, { size: 10, className: "animate-spin" })) : (t("secrets.testStoredValue")) }), secret.docsUrl && (_jsxs("a", { href: secret.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] no-underline text-muted-foreground hover:text-foreground", children: ["Get key", _jsx(IconExternalLink, { size: 10 })] })), secret.status === "set" && (_jsx(Button, { type: "button", intent: "neutral", emphasis: "outline", onClick: () => {
+                                                    setValue("");
+                                                    setIsRotating(false);
+                                                }, disabled: busy !== null, className: "rounded border border-border px-2 py-1 text-[10px] text-muted-foreground hover:text-foreground disabled:opacity-40", children: "Discard" })), _jsx(Button, { type: "button", intent: "primary", emphasis: "solid", onClick: handleSave, disabled: !value.trim() || busy !== null, className: "inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] font-medium disabled:opacity-40", style: { backgroundColor: "#00B5FF", color: "white" }, children: busy === "save" ? (_jsx(IconLoader2, { size: 10, className: "animate-spin" })) : ("Save") })] })] })), confirmDelete && (_jsxs("div", { className: "flex items-center gap-1.5 rounded border border-red-500/30 bg-red-500/10 px-2 py-1.5 text-[10px] text-red-500", children: [_jsx("span", { className: "min-w-0 flex-1", children: "Remove this saved value?" }), _jsx(Button, { type: "button", intent: "danger", emphasis: "solid", onClick: handleDelete, disabled: busy !== null, className: "inline-flex items-center gap-1 rounded border border-red-500/40 px-1.5 py-0.5 font-medium disabled:opacity-40", children: busy === "delete" ? (_jsx(IconLoader2, { size: 10, className: "animate-spin" })) : ("Confirm") }), _jsx(Button, { type: "button", intent: "neutral", emphasis: "outline", onClick: () => setConfirmDelete(false), disabled: busy !== null, className: "rounded border border-border px-1.5 py-0.5 text-muted-foreground hover:text-foreground disabled:opacity-40", children: "Cancel" })] }))] })), toast && (_jsx("p", { className: `mt-1.5 text-[10px] ${toast.kind === "ok" ? "text-green-500" : "text-red-500"}`, children: toast.text }))] }))] }));
 }
 const ADHOC_ENDPOINT = agentNativePath("/_agent-native/secrets/adhoc");
 function AdHocKeysSection({ showForm, onShowFormChange, showEmptyState, }) {

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,10 +77,10 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;
 //# sourceMappingURL=awareness.d.ts.map

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,12 +17,12 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
+    error?: undefined;
 }>;
 export default _default;
 //# sourceMappingURL=upload-image.d.ts.map

package/dist/jobs/actions/run-automation-now.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    name: string;
+    scope?: "organization" | "personal";
+}, import("../run-now.js").QueuedAutomationRun>;
+export default _default;
+//# sourceMappingURL=run-automation-now.d.ts.map

package/dist/jobs/actions/run-automation-now.js

@@ -0,0 +1,22 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { queueAutomationRunNow } from "../run-now.js";
+export default defineAction({
+    description: "Run one personal or organization automation immediately. This is an explicit send/run action and may perform the automation's real side effects.",
+    agentTool: false,
+    schema: z.object({
+        name: z.string().min(1),
+        scope: z.enum(["personal", "organization"]).default("personal"),
+    }),
+    run: async ({ name, scope }, ctx) => {
+        if (!ctx?.userEmail)
+            throw new Error("Not authenticated.");
+        return queueAutomationRunNow({
+            userEmail: ctx.userEmail,
+            orgId: ctx.orgId,
+            scope,
+            name,
+        });
+    },
+});
+//# sourceMappingURL=run-automation-now.js.map

package/dist/jobs/background-automation-runner.d.ts

@@ -32,6 +32,8 @@ export interface BackgroundAutomationRunOptions {
     requestContext?: Omit<RequestContext, "userEmail" | "orgId">;
     actionCaller?: ActionCaller;
     actionAutomation?: ActionAutomationContext;
+    /** Reuse a history row created by a durable run-now enqueue. */
+    historyId?: string;
 }
 export interface BackgroundAutomationRunResult {
     responseText: string;

package/dist/jobs/background-automation-runner.js

@@ -152,29 +152,35 @@ export async function runBackgroundAutomation(options, deps) {
     // that cannot be written should cost us the record, not the automation.
     // Everything downstream tolerates a null id by skipping its own write.
     let historyId = null;
-    try {
-        const historyOwner = options.orgId
-            ? organizationResourceOwner(options.orgId)
-            : automation.resource.owner === "__shared__"
-                ? options.ownerEmail
-                : automation.resource.owner;
-        historyId = await startAutomationRun({
-            owner: historyOwner,
-            automation: automation.name,
-            path: automation.resource.path,
-            scope: options.orgId ? "organization" : "personal",
-            orgId: options.orgId ?? null,
-        });
+    if (options.historyId) {
+        historyId = options.historyId;
     }
-    catch (err) {
-        console.error(`[automations] Could not open a history record for "${automation.name}"; running anyway:`, err);
+    else {
+        try {
+            const historyOwner = options.orgId
+                ? organizationResourceOwner(options.orgId)
+                : automation.resource.owner === "__shared__"
+                    ? options.ownerEmail
+                    : automation.resource.owner;
+            historyId = await startAutomationRun({
+                owner: historyOwner,
+                automation: automation.name,
+                path: automation.resource.path,
+                scope: options.orgId ? "organization" : "personal",
+                orgId: options.orgId ?? null,
+            });
+        }
+        catch (err) {
+            console.error(`[automations] Could not open a history record for "${automation.name}"; running anyway:`, err);
+        }
     }
     let result;
     try {
         result = await executeBackgroundAutomation(options, deps, historyId);
     }
     catch (err) {
-        await recordRunOutcome(historyId, "error", err instanceof Error ? err.message : String(err));
+        const message = err instanceof Error ? err.message : String(err);
+        await recordRunOutcome(historyId, "error", `${message}. No delivery was confirmed.`);
         throw err;
     }
     // Outside the try: history is bookkeeping about the run, so a failure to

package/dist/jobs/run-history.d.ts

@@ -27,13 +27,27 @@ export interface StartAutomationRunInput {
     orgId?: string | null;
     runId?: string | null;
     threadId?: string | null;
+    /** A pre-created row still waiting for its background worker handoff. */
+    dispatchPending?: boolean;
 }
 /**
- * Record that an automation actually began executing. Returns the run id used
- * to close the record out. Only real executions get a row — a tick that
- * declined to run the automation must not appear in its history.
+ * Record an automation execution. Manual runs create the row before dispatch,
+ * so `dispatchPending` distinguishes that durable handoff from a run that has
+ * already entered the worker.
  */
 export declare function startAutomationRun(input: StartAutomationRunInput): Promise<string>;
+export declare function getAutomationRun(id: string): Promise<AutomationRun | null>;
+/** Claim a manually queued run exactly once before loading its automation. */
+export declare function claimAutomationRun(id: string): Promise<boolean>;
+/**
+ * Find manual handoffs that have stayed unclaimed long enough to have missed
+ * their first self-dispatch. The row is the durable queue; callers may safely
+ * redeliver it because claimAutomationRun is an atomic CAS.
+ */
+export declare function listUnclaimedAutomationRuns(options?: {
+    olderThanMs?: number;
+    limit?: number;
+}): Promise<AutomationRun[]>;
 export declare function finishAutomationRun(id: string, status: Exclude<AutomationRunStatus, "running">, error?: string): Promise<void>;
 /**
  * Attach the agent thread once it exists. The thread is created after the run

package/dist/jobs/run-history.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { getDbExec, intType, isPostgres } from "../db/client.js";
-import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
+import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../db/ddl-guard.js";
 const TABLE = "automation_runs";
 const MAX_ERROR_LENGTH = 500;
 /**
@@ -8,6 +8,10 @@ const MAX_ERROR_LENGTH = 500;
  * (BACKGROUND_RUN_HARD_TIMEOUT_MS). Past this, no run is still alive.
  */
 const RUN_LIVENESS_CEILING_MS = 15 * 60_000;
+// The background worker has a shorter hard timeout than this lease. A worker
+// that dies after claiming can therefore be redelivered without overlapping a
+// still-live execution under normal runtime limits.
+const CLAIM_LEASE_MS = RUN_LIVENESS_CEILING_MS;
 /** Rows kept per automation, so a per-minute schedule cannot grow forever. */
 const RUNS_RETAINED_PER_AUTOMATION = 50;
 let _initPromise;
@@ -28,16 +32,39 @@ async function ensureTable() {
           status TEXT NOT NULL DEFAULT 'running',
           started_at ${intType()} NOT NULL,
           finished_at ${intType()},
-          error TEXT
+          error TEXT,
+          claimed_at ${intType()},
+          dispatch_pending ${intType()} NOT NULL DEFAULT 0
         )
       `;
             const indexSql = `CREATE INDEX IF NOT EXISTS idx_${TABLE}_owner_automation ON ${TABLE} (owner, automation, started_at)`;
             if (isPostgres()) {
                 await ensureTableExists(TABLE, createSql);
+                await ensureColumnExists(TABLE, "claimed_at", `ALTER TABLE ${TABLE} ADD COLUMN IF NOT EXISTS claimed_at ${intType()}`);
+                await ensureColumnExists(TABLE, "dispatch_pending", `ALTER TABLE ${TABLE} ADD COLUMN IF NOT EXISTS dispatch_pending ${intType()} NOT NULL DEFAULT 0`);
                 await ensureIndexExists(`idx_${TABLE}_owner_automation`, indexSql);
                 return;
             }
             await client.execute(createSql);
+            const { rows } = await client.execute(`PRAGMA table_info("${TABLE}")`);
+            const columns = new Set(rows.map((row) => String(row.name)));
+            for (const [name, definition] of [
+                ["claimed_at", `${intType()}`],
+                ["dispatch_pending", `${intType()} NOT NULL DEFAULT 0`],
+            ]) {
+                if (columns.has(name))
+                    continue;
+                try {
+                    await client.execute(`ALTER TABLE ${TABLE} ADD COLUMN ${name} ${definition}`);
+                }
+                catch (error) {
+                    const message = String(error?.message ?? error);
+                    if (!/duplicate column name/i.test(message) &&
+                        !/column .* already exists/i.test(message)) {
+                        throw error;
+                    }
+                }
+            }
             await client.execute(indexSql);
         })().catch((err) => {
             _initPromise = undefined;
@@ -68,16 +95,16 @@ function toRun(row, now) {
     };
 }
 /**
- * Record that an automation actually began executing. Returns the run id used
- * to close the record out. Only real executions get a row — a tick that
- * declined to run the automation must not appear in its history.
+ * Record an automation execution. Manual runs create the row before dispatch,
+ * so `dispatchPending` distinguishes that durable handoff from a run that has
+ * already entered the worker.
  */
 export async function startAutomationRun(input) {
     await ensureTable();
     const id = randomUUID();
     await getDbExec().execute({
-        sql: `INSERT INTO ${TABLE} (id, owner, automation, path, scope, org_id, run_id, thread_id, status, started_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'running', ?)`,
+        sql: `INSERT INTO ${TABLE} (id, owner, automation, path, scope, org_id, run_id, thread_id, status, started_at, dispatch_pending)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'running', ?, ?)`,
         args: [
             id,
             input.owner,
@@ -88,11 +115,50 @@ export async function startAutomationRun(input) {
             input.runId ?? null,
             input.threadId ?? null,
             Date.now(),
+            input.dispatchPending ? 1 : 0,
         ],
     });
     await pruneAutomationRuns(input.owner, input.automation);
     return id;
 }
+export async function getAutomationRun(id) {
+    await ensureTable();
+    const result = await getDbExec().execute({
+        sql: `SELECT * FROM ${TABLE} WHERE id = ? LIMIT 1`,
+        args: [id],
+    });
+    const row = result.rows?.[0];
+    return row ? toRun(row, Date.now()) : null;
+}
+/** Claim a manually queued run exactly once before loading its automation. */
+export async function claimAutomationRun(id) {
+    await ensureTable();
+    const now = Date.now();
+    const result = await getDbExec().execute({
+        sql: `UPDATE ${TABLE} SET claimed_at = ? WHERE id = ? AND dispatch_pending = 1 AND (claimed_at IS NULL OR claimed_at <= ?) AND status = 'running'`,
+        args: [now, id, now - CLAIM_LEASE_MS],
+    });
+    return Number(result.rowsAffected ?? 0) > 0;
+}
+/**
+ * Find manual handoffs that have stayed unclaimed long enough to have missed
+ * their first self-dispatch. The row is the durable queue; callers may safely
+ * redeliver it because claimAutomationRun is an atomic CAS.
+ */
+export async function listUnclaimedAutomationRuns(options) {
+    await ensureTable();
+    const olderThanMs = Math.max(options?.olderThanMs ?? 10_000, 0);
+    const limit = Math.min(Math.max(options?.limit ?? 50, 1), 100);
+    const result = await getDbExec().execute({
+        sql: `SELECT * FROM ${TABLE}
+          WHERE dispatch_pending = 1 AND (claimed_at IS NULL OR claimed_at <= ?) AND status = 'running'
+            AND started_at <= ?
+          ORDER BY started_at ASC LIMIT ${limit}`,
+        args: [Date.now() - CLAIM_LEASE_MS, Date.now() - olderThanMs],
+    });
+    const now = Date.now();
+    return (result.rows ?? []).map((row) => toRun(row, now));
+}
 /**
  * Drop the oldest rows for one automation once it exceeds the retention cap.
  *