@agent-native/core 0.144.3 → 0.145.1

package/dist/server/agent-chat-plugin.js

@@ -24,6 +24,7 @@ import { adoptThreadScopeIfUnscoped, createThread, forkThread, getThread, regist
 import { isCheckpointRestorePath } from "../checkpoints/route-match.js";
 import { createDbAdminAgentTools } from "../db-admin/agent-tools.js";
 import { isTransientDatabaseError } from "../db/client.js";
+import { filterFrameworkToolGroups, resolveFrameworkTools, } from "../framework-tools.js";
 import { verifyInternalToken, extractBearerToken, } from "../integrations/internal-token.js";
 import { RECURRING_JOBS_SWEEP_PATH, RECURRING_JOBS_SWEEP_TOKEN_SUBJECT, } from "../jobs/scheduler-dispatch.js";
 import { McpClientManager, loadMcpConfig, autoDetectMcpConfig, mcpToolsToActionEntries, syncMcpActionEntries, mountMcpServersRoutes, mountMcpHubRoutes, buildMergedConfig, startMcpConfigRefresh, getHubStatus, isHubServeEnabled, } from "../mcp-client/index.js";
@@ -116,6 +117,7 @@ import { isLocalhost, shouldBlockInProductCodeEditingSurface, } from "./agent-ch
 import { loadRunCodeToolEntries } from "./agent-chat/run-code-tools.js";
 import { createAgentEngineScriptEntries, createAgentLoopSettingsScriptEntries, createCallAgentScriptEntry, createChatScriptEntries, createDbScriptEntries, createDocsScriptEntries, createResourceScriptEntries, } from "./agent-chat/script-entries.js";
 import { parseSkillFrontmatter } from "./agent-chat/skill-frontmatter.js";
+import { shouldDisableInProcessSweeps } from "./sweep-runtime.js";
 export { loadResourcesForPrompt };
 export { _agentChatPromptSectionsForTests };
 export { buildPublicAgentA2ASkills };
@@ -277,12 +279,19 @@ export function createAgentChatPlugin(options) {
             // `canToggle` means "this environment allows toggling" (static); this
             // function means "the user currently has dev mode ON" (live).
             const isDevMode = () => currentDevMode;
+            // Resolve the framework's own tool surface once, folding the deprecated
+            // `databaseTools` / `extensionTools` into `frameworkTools` so every
+            // consumer below reads a single shape. Conflicting old/new values throw
+            // here rather than booting with a surface nobody chose.
+            const frameworkTools = resolveFrameworkTools(options);
+            const disabledFrameworkGroups = frameworkTools.disabledGroups;
             // Build the four assembled system prompt strings. These are static for the
             // lifetime of this plugin instance — examples come from options once at
             // startup, not per-request.
             const { PROD_FRAMEWORK_PROMPT, DEV_FRAMEWORK_PROMPT, PROD_FRAMEWORK_PROMPT_COMPACT, DEV_FRAMEWORK_PROMPT_COMPACT, } = buildFrameworkPrompts(options?.promptExamples, {
-                databaseTools: options?.databaseTools,
-                extensionTools: options?.extensionTools,
+                databaseTools: frameworkTools.database,
+                extensionTools: frameworkTools.extensions,
+                disabledFrameworkGroups,
             });
             // Route readiness must not wait on settings scans, remote hub fetches, or
             // third-party MCP handshakes. Build the action surface against an empty
@@ -397,13 +406,23 @@ export function createAgentChatPlugin(options) {
             catch {
                 // Package action registration is optional.
             }
-            // Resource, chat, docs, db, and cross-agent scripts are available in both prod and dev modes
-            const resourceScripts = await createResourceScriptEntries();
-            const docsScripts = await createDocsScriptEntries();
-            const databaseToolsMode = normalizeDatabaseToolsMode(options?.databaseTools);
+            // Resource, chat, docs, db, and cross-agent scripts are available in both
+            // prod and dev modes, unless the app switched the group off through
+            // `frameworkTools`. Gating at construction is deliberate: an empty map
+            // flows through all thirteen registry composition sites below, whereas a
+            // condition at each spread site is the same omission waiting to happen
+            // thirteen times. Matching HTTP routes are mounted from `httpActions`,
+            // which is built from the ungated sets so the UI keeps working.
+            const resourceScripts = frameworkTools.isEnabled("resources")
+                ? await createResourceScriptEntries()
+                : {};
+            const docsScripts = frameworkTools.isEnabled("docs")
+                ? await createDocsScriptEntries()
+                : {};
+            const databaseToolsMode = normalizeDatabaseToolsMode(frameworkTools.database);
             const databaseToolsEnabled = databaseToolsMode !== "off";
             const databaseWriteToolsEnabled = databaseToolsMode === "write";
-            const extensionToolsEnabled = options?.extensionTools === true;
+            const extensionToolsEnabled = frameworkTools.extensions;
             const dbScripts = databaseToolsEnabled
                 ? await createDbScriptEntries(databaseToolsMode, {
                     extensionTools: extensionToolsEnabled,
@@ -417,12 +436,20 @@ export function createAgentChatPlugin(options) {
             const urlTools = createUrlTools();
             const engineScripts = await createAgentEngineScriptEntries(options?.appId);
             const loopSettingsScripts = await createAgentLoopSettingsScriptEntries();
-            const chatScripts = {
-                ...(await createChatScriptEntries()),
-                ...engineScripts,
-                ...loopSettingsScripts,
-            };
-            const callAgentScript = await createCallAgentScriptEntry(options?.appId);
+            // `httpActions` spreads engineScripts/loopSettingsScripts directly, so
+            // gating here removes them from the agent's tools without unmounting the
+            // routes the settings UI calls.
+            const chatScripts = frameworkTools.isEnabled("chat")
+                ? {
+                    ...(await createChatScriptEntries()),
+                    ...engineScripts,
+                    ...loopSettingsScripts,
+                }
+                : {};
+            // Both `call-agent` and `describe-workspace-apps` come from this factory.
+            const callAgentScript = frameworkTools.isEnabled("workspaceApps")
+                ? await createCallAgentScriptEntry(options?.appId)
+                : {};
             let runNowSchedulerDeps = null;
             const browserTools = createBuilderBrowserTool({
                 getOrigin: () => getRequestRunContext()?.requestOrigin ?? "http://localhost:3000",
@@ -582,7 +609,13 @@ export function createAgentChatPlugin(options) {
             // surface, prompt, MCP/A2A list, and job/trigger runner below. The full
             // `*All` sets are reserved for `httpActions`, which keeps agent-hidden
             // actions reachable from the frontend / HTTP.
-            const templateScripts = filterAgentTools(templateScriptsAll);
+            //
+            // The framework's own action kits (sharing, review, history, flags, …)
+            // arrive in this same registry through `autoDiscoverActions`, tagged with
+            // `frameworkGroup`. Subtracting disabled groups HERE is what removes them
+            // from every downstream agent surface at once; `httpActions` re-merges
+            // them ungated, so the share dialog and review threads keep their routes.
+            const templateScripts = filterFrameworkToolGroups(filterAgentTools(templateScriptsAll), disabledFrameworkGroups);
             // Compact is the safe default for every app, including generated and
             // third-party apps that have not curated a starter list yet. Keep the
             // app's own action surface immediately callable; framework, provider,
@@ -592,7 +625,7 @@ export function createAgentChatPlugin(options) {
             // (below, after the run-code tools are built) additionally folds in
             // whatever `generateCorpusToolsPrompt` teaches by name for this request.
             const templateInitialToolNames = resolveInitialToolNames(templateScripts, options?.initialToolNames);
-            const discoveredActions = filterAgentTools(discoveredActionsAll);
+            const discoveredActions = filterFrameworkToolGroups(filterAgentTools(discoveredActionsAll), disabledFrameworkGroups);
             // Per-request owner is read from the AsyncLocalStorage run context
             // (populated by prepareRun). Module-scope `let` would race across
             // concurrent requests on a long-lived Node process — overlapping
@@ -628,22 +661,29 @@ export function createAgentChatPlugin(options) {
             // Automation tools + fetch tool — depend on owner via callback.
             // Each callback short-circuits with a clear error when the run context
             // has no authenticated owner (see SECURITY note on getCurrentRunOwner).
+            const automationGroupEnabled = frameworkTools.isEnabled("automation");
             let automationTools = {};
             try {
-                const { createAutomationToolEntries } = await import("../triggers/actions.js");
-                automationTools = createAutomationToolEntries(() => requireCurrentRunOwner("manage automations"));
+                if (automationGroupEnabled) {
+                    const { createAutomationToolEntries } = await import("../triggers/actions.js");
+                    automationTools = createAutomationToolEntries(() => requireCurrentRunOwner("manage automations"));
+                }
             }
             catch { }
             let notificationTools = {};
             try {
-                const { createNotificationToolEntries } = await import("../notifications/actions.js");
-                notificationTools = createNotificationToolEntries(() => requireCurrentRunOwner("manage notifications"));
+                if (automationGroupEnabled) {
+                    const { createNotificationToolEntries } = await import("../notifications/actions.js");
+                    notificationTools = createNotificationToolEntries(() => requireCurrentRunOwner("manage notifications"));
+                }
             }
             catch { }
             let progressTools = {};
             try {
-                const { createProgressToolEntries } = await import("../progress/actions.js");
-                progressTools = createProgressToolEntries(() => requireCurrentRunOwner("manage progress"));
+                if (automationGroupEnabled) {
+                    const { createProgressToolEntries } = await import("../progress/actions.js");
+                    progressTools = createProgressToolEntries(() => requireCurrentRunOwner("manage progress"));
+                }
             }
             catch { }
             let githubRepoTools = {};
@@ -661,48 +701,53 @@ export function createAgentChatPlugin(options) {
                 });
             }
             catch { }
+            const webGroupEnabled = frameworkTools.isEnabled("web");
             let fetchTool = {};
             try {
-                const { createFetchToolEntry } = await import("../extensions/fetch-tool.js");
-                // Resolve `${keys.NAME}` through the same request-scope cascade
-                // already used by extension fetches (extensions/routes.ts) and
-                // automation connector headers (automation/index.ts): user scope
-                // first (personal overrides win), then the active org scope (the
-                // Dispatch vault syncs workspace secrets here), then workspace
-                // scope. Org/workspace vault rows are write-gated (org-admin +
-                // Dispatch vault UI), so this is safe to read by default — unlike
-                // the opt-in-only user→workspace fallback in resolveKeyReferences
-                // (see audit 05 H2 in secrets/substitution.ts), which stays off.
-                // Previously this tool only looked at scope "user", so a
-                // ${keys.NAME} reference to a key synced into the org/workspace
-                // vault could never resolve here even though the same key already
-                // worked for extension fetches and automations.
-                const { resolveKeyReferencesWithRequestScopes, validateUrlAllowlist, getKeyAllowlist, getResolvedKeyAllowlist, } = await import("../secrets/substitution.js");
-                fetchTool = createFetchToolEntry({
-                    resolveKeys: async (text) => resolveKeyReferencesWithRequestScopes(text, requireCurrentRunOwner("resolve key references")),
-                    validateUrl: async (url, usedKeys, resolvedKeys) => {
-                        for (const keyName of usedKeys) {
-                            const allowlist = await resolveFetchToolKeyAllowlist(keyName, resolvedKeys, requireCurrentRunOwner("validate URL allowlist"), { getKeyAllowlist, getResolvedKeyAllowlist });
-                            if (allowlist && !validateUrlAllowlist(url, allowlist)) {
-                                return false;
+                if (webGroupEnabled) {
+                    const { createFetchToolEntry } = await import("../extensions/fetch-tool.js");
+                    // Resolve `${keys.NAME}` through the same request-scope cascade
+                    // already used by extension fetches (extensions/routes.ts) and
+                    // automation connector headers (automation/index.ts): user scope
+                    // first (personal overrides win), then the active org scope (the
+                    // Dispatch vault syncs workspace secrets here), then workspace
+                    // scope. Org/workspace vault rows are write-gated (org-admin +
+                    // Dispatch vault UI), so this is safe to read by default — unlike
+                    // the opt-in-only user→workspace fallback in resolveKeyReferences
+                    // (see audit 05 H2 in secrets/substitution.ts), which stays off.
+                    // Previously this tool only looked at scope "user", so a
+                    // ${keys.NAME} reference to a key synced into the org/workspace
+                    // vault could never resolve here even though the same key already
+                    // worked for extension fetches and automations.
+                    const { resolveKeyReferencesWithRequestScopes, validateUrlAllowlist, getKeyAllowlist, getResolvedKeyAllowlist, } = await import("../secrets/substitution.js");
+                    fetchTool = createFetchToolEntry({
+                        resolveKeys: async (text) => resolveKeyReferencesWithRequestScopes(text, requireCurrentRunOwner("resolve key references")),
+                        validateUrl: async (url, usedKeys, resolvedKeys) => {
+                            for (const keyName of usedKeys) {
+                                const allowlist = await resolveFetchToolKeyAllowlist(keyName, resolvedKeys, requireCurrentRunOwner("validate URL allowlist"), { getKeyAllowlist, getResolvedKeyAllowlist });
+                                if (allowlist && !validateUrlAllowlist(url, allowlist)) {
+                                    return false;
+                                }
                             }
-                        }
-                        return true;
-                    },
-                });
+                            return true;
+                        },
+                    });
+                }
             }
             catch { }
             let webSearchTool = {};
             try {
-                const { createWebSearchToolEntry } = await import("../extensions/web-search-tool.js");
-                const { getBuilderWebSearchBaseUrl, resolveBuilderCredentials, resolveSecret, } = await import("./credential-provider.js");
-                const { getBuilderGatewayRequestHeaders } = await import("../agent/engine/builder-gateway-headers.js");
-                webSearchTool = createWebSearchToolEntry({
-                    resolveSecret,
-                    resolveBuilderCredentials,
-                    getBuilderWebSearchBaseUrl,
-                    getBuilderRequestHeaders: getBuilderGatewayRequestHeaders,
-                });
+                if (webGroupEnabled) {
+                    const { createWebSearchToolEntry } = await import("../extensions/web-search-tool.js");
+                    const { getBuilderWebSearchBaseUrl, resolveBuilderCredentials, resolveSecret, } = await import("./credential-provider.js");
+                    const { getBuilderGatewayRequestHeaders } = await import("../agent/engine/builder-gateway-headers.js");
+                    webSearchTool = createWebSearchToolEntry({
+                        resolveSecret,
+                        resolveBuilderCredentials,
+                        getBuilderWebSearchBaseUrl,
+                        getBuilderRequestHeaders: getBuilderGatewayRequestHeaders,
+                    });
+                }
             }
             catch { }
             let workspaceFilesTool = {};
@@ -752,11 +797,13 @@ export function createAgentChatPlugin(options) {
             let coreEmailTools = {};
             let backgroundCoreEmailTools = {};
             try {
-                const { createCoreEmailActionEntries } = await import("./email-actions.js");
-                coreEmailTools = createCoreEmailActionEntries();
-                backgroundCoreEmailTools = createCoreEmailActionEntries({
-                    unattended: true,
-                });
+                if (frameworkTools.isEnabled("email")) {
+                    const { createCoreEmailActionEntries } = await import("./email-actions.js");
+                    coreEmailTools = createCoreEmailActionEntries();
+                    backgroundCoreEmailTools = createCoreEmailActionEntries({
+                        unattended: true,
+                    });
+                }
             }
             catch { }
             // Core read-attachment tool — always registered so the agent can page
@@ -1233,7 +1280,7 @@ export function createAgentChatPlugin(options) {
                     const devActive = isDevMode();
                     // Build the same system prompt the interactive agent uses
                     const owner = userEmail;
-                    const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId);
+                    const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
                     const schemaBlock = lazyContext
                         ? ""
                         : await buildSchemaBlock(owner, databaseToolsMode);
@@ -1701,7 +1748,7 @@ export function createAgentChatPlugin(options) {
                         // catalog on its very first request, undermining the compact MCP
                         // catalog this surface is supposed to keep external callers on.
                         const mcpToolSurface = createA2AEngineToolSurface(actionsToEngineTools(mcpActions), effectiveInitialToolNames);
-                        const resources = await loadResourcesForPrompt(SHARED_OWNER, lazyContext, options?.appId);
+                        const resources = await loadResourcesForPrompt(SHARED_OWNER, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
                         const schemaBlock = lazyContext
                             ? ""
                             : await buildSchemaBlock(SHARED_OWNER, databaseToolsMode);
@@ -2156,8 +2203,10 @@ export function createAgentChatPlugin(options) {
             // Job management tool (manage-jobs)
             let jobTools = {};
             try {
-                const { createJobTools } = await import("../jobs/tools.js");
-                jobTools = createJobTools();
+                if (automationGroupEnabled) {
+                    const { createJobTools } = await import("../jobs/tools.js");
+                    jobTools = createJobTools();
+                }
             }
             catch { }
             // Lean mode: only template actions + essential framework tools. Drop
@@ -2487,7 +2536,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             modelOverlay +
                             runtimeContext);
                     }
-                    const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId);
+                    const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
                     // In lazy context mode, skip embedding the full schema. When database
                     // tools are enabled the agent can call `db-schema` on demand.
                     const schemaBlock = lazyContext
@@ -2720,7 +2769,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             });
                             return setSystemPromptOnContext(leanBasePrompt + extra + modelOverlay + runtimeContext);
                         }
-                        const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId);
+                        const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
                         const schemaBlock = lazyContext || !databaseToolsEnabled
                             ? ""
                             : await buildSchemaBlock(owner, databaseToolsMode);
@@ -4687,6 +4736,17 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             }));
             const isBackgroundRuntime = isInBackgroundFunctionRuntime();
             const disableRecurringJobsRuntime = isBackgroundRuntime || shouldDisableRecurringJobsRuntime();
+            // Opt-in kill switch for the backstop sweep timers below. On serverless
+            // these are billed per warm container, so their query rate scales with
+            // instance count rather than with anything happening. See
+            // `shouldDisableInProcessSweeps`.
+            const sweepsDisabled = shouldDisableInProcessSweeps();
+            if (sweepsDisabled) {
+                console.log("[agent-native] In-process backstop sweeps disabled " +
+                    "(AGENT_NATIVE_DISABLE_INPROCESS_SWEEPS). A durable scheduler must " +
+                    "drive automation redispatch, agent-teams reconciliation, and " +
+                    "sandbox-execution recovery, or queued work will not be retried.");
+            }
             // ─── Recurring Jobs Scheduler ──────────────────────────────────────
             // Poll every 60 seconds for due recurring jobs and execute them.
             // Uses setInterval so it works in all deployment environments without
@@ -4696,7 +4756,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 const schedulerDeps = {
                     getActions: getBackgroundActionEntries,
                     getSystemPrompt: async (owner) => {
-                        const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId);
+                        const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
                         const schemaBlock = lazyContext
                             ? ""
                             : await buildSchemaBlock(owner, databaseToolsMode);
@@ -4712,8 +4772,11 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     // fetchTool/webSearchTool/toolActions catalog every tick.
                     getInitialToolNames: (job) => [
                         ...effectiveInitialToolNames,
-                        "manage-jobs",
-                        "manage-progress",
+                        // Only promotable while the group that supplies them is on; with
+                        // `automation` off the prompt no longer names them either.
+                        ...(automationGroupEnabled
+                            ? ["manage-jobs", "manage-progress"]
+                            : []),
                         ...(job?.meta.mcpTools ?? []),
                     ],
                     apiKey: options?.apiKey,
@@ -4781,7 +4844,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // A non-Netlify self-dispatch only waits for the request to leave the
             // current invocation. Keep the durable history row as a retryable queue
             // so a frozen serverless handoff is recovered on the next sweep.
-            if (!isBackgroundRuntime) {
+            if (!isBackgroundRuntime && !sweepsDisabled) {
                 (() => {
                     let inFlight = false;
                     const sweep = async () => {
@@ -4813,7 +4876,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // per instance; cheap (one indexed query when no active tasks are found).
             // Throttled by the same per-owner interval guard inside reconcileAgentTeamRunsForOwner.
             (() => {
-                if (isBackgroundRuntime)
+                if (isBackgroundRuntime || sweepsDisabled)
                     return;
                 // Track when this instance last ran the sweep so only one sweep fires
                 // per 2-min window even if multiple timers fire in overlapping invocations.
@@ -4962,7 +5025,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // comment above for why this exists and the timing budget in
             // run-store.ts's `UNCLAIMED_BACKGROUND_RUN_FAST_SWEEP_MS` doc comment.
             (() => {
-                if (isBackgroundRuntime)
+                if (isBackgroundRuntime || sweepsDisabled)
                     return;
                 setTimeout(() => {
                     (async () => {
@@ -5005,7 +5068,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // still fails loud, and it survives the fast sweep having missed a row
             // entirely (e.g. a restart landed between fast-sweep ticks).
             (() => {
-                if (isBackgroundRuntime)
+                if (isBackgroundRuntime || sweepsDisabled)
                     return;
                 let lastSweep = 0;
                 const SWEEP_INTERVAL_MS = 2 * 60 * 1000;
@@ -5073,7 +5136,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     await initTriggerDispatcher({
                         getActions: getBackgroundActionEntries,
                         getSystemPrompt: async (owner) => {
-                            const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId);
+                            const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
                             const schemaBlock = lazyContext
                                 ? ""
                                 : await buildSchemaBlock(owner, databaseToolsMode);

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/auth.d.ts

@@ -226,6 +226,9 @@ export declare function removeSession(token: string): Promise<void>;
 /**
  * Look up the email associated with a legacy session token.
  * Returns null if the session doesn't exist, is expired, or has no email.
+ *
+ * Resolutions are cached across requests — see `session-email-cache.ts` for the
+ * TTL and the only-cache-successes rule.
  */
 export declare function getSessionEmail(token: string): Promise<string | null>;
 export interface DesktopExchangeErrorPayload {

package/dist/server/auth.js

@@ -71,6 +71,7 @@ import { isIdentitySsoEnabled } from "./identity-sso-store.js";
 import { safeOAuthReturnUrl } from "./oauth-return-url.js";
 import { getOnboardingHtml, getResetPasswordHtml, } from "./onboarding-html.js";
 import { captureAuthError } from "./sentry.js";
+import { forgetCachedSessionEmail, getCachedSessionEmail, invalidateSessionEmailCache, setCachedSessionEmail, } from "./session-email-cache.js";
 import { isWorkspaceOAuthCallbackRelayEnabled } from "./workspace-oauth.js";
 /**
  * Get the configured session max age. Desktop SSO broker writes from
@@ -741,6 +742,9 @@ export async function addSession(token, email) {
             : `INSERT OR REPLACE INTO sessions (token, email, created_at) VALUES (?, ?, ?)`,
         args: [token, email ?? null, Date.now()],
     }));
+    // The upsert can REBIND an existing token to a different email, so a cached
+    // resolution for it is now wrong.
+    invalidateSessionEmailCache();
 }
 export async function hasLegacySessionForEmail(email) {
     await ensureSessionTable();
@@ -759,12 +763,20 @@ export async function removeSession(token) {
         sql: `DELETE FROM sessions WHERE token = ?`,
         args: [token],
     }));
+    // Sign-out must take effect immediately, not after the cache TTL.
+    invalidateSessionEmailCache();
 }
 /**
  * Look up the email associated with a legacy session token.
  * Returns null if the session doesn't exist, is expired, or has no email.
+ *
+ * Resolutions are cached across requests — see `session-email-cache.ts` for the
+ * TTL and the only-cache-successes rule.
  */
 export async function getSessionEmail(token) {
+    const cached = getCachedSessionEmail(token);
+    if (cached !== undefined)
+        return cached;
     await ensureSessionTable();
     const client = getDbExec();
     const { rows } = await retryIfSessionsMissing(() => client.execute({
@@ -779,9 +791,13 @@ export async function getSessionEmail(token) {
             sql: `DELETE FROM sessions WHERE token = ?`,
             args: [token],
         });
+        forgetCachedSessionEmail(token);
         return null;
     }
-    return rows[0].email ?? null;
+    const email = rows[0].email ?? null;
+    if (email)
+        setCachedSessionEmail(token, email);
+    return email;
 }
 // ---------------------------------------------------------------------------
 // getSession — the auth contract
@@ -937,6 +953,7 @@ async function consumeDesktopExchangeFromDB(flowId) {
             sql: `DELETE FROM sessions WHERE token = ? AND created_at > ? RETURNING email`,
             args: [`dex:${flowId}`, Date.now() - DESKTOP_EXCHANGE_TTL_MS],
         });
+        forgetCachedSessionEmail(`dex:${flowId}`);
         if (rows.length === 0)
             return null;
         const packed = (rows[0].email ?? rows[0][0]);
@@ -2706,6 +2723,9 @@ async function mountBetterAuthRoutes(app, options) {
                                 args: [userEmail],
                             });
                         }
+                        // Deleted by email, so the removed tokens are unknown here — the
+                        // whole cache goes.
+                        invalidateSessionEmailCache();
                     }
                 }
                 catch {
@@ -2939,6 +2959,7 @@ async function mountBetterAuthRoutes(app, options) {
             catch {
                 // Best-effort.
             }
+            invalidateSessionEmailCache();
             // 3. Drop the current request's cookie and best-effort sign out
             // of Better Auth (so the response sets the proper expiry header).
             clearFrameworkSessionCookies(event);

package/dist/server/collab-plugin.js

@@ -211,8 +211,12 @@ export function createCollabPlugin(options = {}) {
                         (action === "json" && method === "POST") ||
                         (action === "patch" && method === "POST");
                     if (isWrite) {
-                        // assertAccess throws ForbiddenError (→ 403) if no editor access
-                        const access = await assertAccess(resourceType, resourceId, "editor");
+                        // assertAccess throws ForbiddenError (→ 403) if no editor access.
+                        // Projected: only ownerEmail/orgId are read below, and a collab
+                        // resource's body is the largest column it has — loading it here
+                        // means every keystroke-driven update read the whole document
+                        // twice, once for the ACL and once for the edit itself.
+                        const access = await assertAccess(resourceType, resourceId, "editor", undefined, { skipResourceBody: true });
                         const resource = access.resource;
                         const awarenessScope = {
                             resourceType,
@@ -229,8 +233,10 @@ export function createCollabPlugin(options = {}) {
                         }
                     }
                     else {
-                        // resolveAccess returns null when no access; return 404 to avoid leaking existence
-                        const access = await resolveAccess(resourceType, resourceId);
+                        // resolveAccess returns null when no access; return 404 to avoid leaking existence.
+                        // Projected: only ownerEmail/orgId are read below, and a collab
+                        // resource's body is the largest column it has.
+                        const access = await resolveAccess(resourceType, resourceId, undefined, { skipResourceBody: true });
                         if (!access) {
                             setResponseStatus(event, 404);
                             return { error: "Not found" };

package/dist/server/core-routes-plugin.js

@@ -57,6 +57,7 @@ import { createPollHandler } from "./poll.js";
 import { createRealtimeTokenHandler } from "./realtime-token.js";
 import { getRequestContext, hasRequestContext, runWithRequestContext, } from "./request-context.js";
 import { findUnsupportedScopedKeyNames, saveKeyValuesToScopedSecrets, ScopedKeyStorageError, } from "./scoped-key-storage.js";
+import { shouldDisableInProcessSweeps } from "./sweep-runtime.js";
 import { createTranscribeVoiceHandler } from "./transcribe-voice.js";
 import { createVoiceProvidersStatusHandler } from "./voice-providers-status.js";
 import { createWorkspaceProviderOAuthHandler } from "./workspace-provider-oauth.js";
@@ -1260,6 +1261,8 @@ export function createCoreRoutesPlugin(options = {}) {
             // poll-time drain in run-code covers deployments where warm-instance
             // timers rarely fire.
             (() => {
+                if (shouldDisableInProcessSweeps())
+                    return;
                 let lastSweep = 0;
                 const SWEEP_INTERVAL_MS = 2 * 60 * 1000;
                 setTimeout(() => {

package/dist/server/prompts/framework-core-compact.d.ts

@@ -8,11 +8,16 @@
  *   - Detailed "Parallel Tool Calls" prose (replaced with one-liner)
  *   - Detailed "Resources" section (agent uses resources tool)
  */
+import { type FrameworkToolGroup } from "../../framework-tools.js";
 import { type DatabaseToolsOption } from "../../scripts/db/tool-mode.js";
 import { type PromptExamples } from "./shared-rules.js";
 export interface FrameworkCoreCompactPromptOptions {
     databaseTools?: DatabaseToolsOption;
     extensionTools?: boolean;
+    /** Framework tool groups this app switched off. Every block below that names
+     *  a group's tool by name is gated on this — a prompt naming an absent tool
+     *  makes the model call it, fail, and often report the capability as missing. */
+    disabledFrameworkGroups?: ReadonlySet<FrameworkToolGroup>;
 }
 /**
  * Build the compact FRAMEWORK_CORE prompt string.