@agent-native/core 0.145.0 → 0.145.1

package/dist/resources/store.js

@@ -4,6 +4,7 @@ import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../db
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 import { canUseLocalWorkspaceResourcePath, deleteLocalWorkspaceResource, isLocalWorkspaceResourceId, isLocalWorkspaceResourcesEnabled, listLocalWorkspaceResources, localWorkspaceResourcePathFromId, readLocalWorkspaceResource, writeLocalWorkspaceResource, } from "../local-artifacts/index.js";
 import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
+import { getSetting, putSetting, } from "../settings/store.js";
 import { emitResourceChange, emitResourceDelete } from "./emitter.js";
 export const SHARED_OWNER = "__shared__";
 export const WORKSPACE_OWNER = "__workspace__";
@@ -570,14 +571,34 @@ async function grantedWorkspaceResourceByPath(path, options) {
         return null;
     }
 }
-async function cleanupExpiredAgentScratchResources(client) {
+/**
+ * Expire agent scratch resources, WITHOUT blocking the read that triggered it.
+ *
+ * This is garbage collection, not part of any read's answer: a caller asking for
+ * one resource does not need yesterday's expired scratch rows gone first. Awaiting
+ * it made every read path issue a `DELETE` before its own `SELECT` — double the
+ * round trips, unservable by a replica, taking row locks inside a request a user
+ * is waiting on, and (since nothing caught it) able to fail the read outright.
+ *
+ * The throttle is a module-scope timestamp, so it starts at 0 in a fresh isolate
+ * and the first resource read after every cold start still triggers one sweep.
+ * That is why the index below exists, and why this must not be awaited.
+ */
+function scheduleExpiredAgentScratchCleanup(client) {
     const now = Date.now();
     if (now - _lastScratchCleanupAt < SCRATCH_CLEANUP_INTERVAL_MS)
         return;
     _lastScratchCleanupAt = now;
-    await client.execute({
+    void client
+        .execute({
         sql: `DELETE FROM resources WHERE visibility = ? AND expires_at IS NOT NULL AND expires_at <= ?`,
         args: ["agent_scratch", now],
+    })
+        .catch((err) => {
+        // Say so rather than swallowing: scratch rows accumulating forever is a
+        // slow leak nobody would otherwise notice.
+        // coercion-ok: failed GC degrades storage over time, never read correctness
+        console.warn("[resources] expired agent-scratch cleanup failed; will retry on a later read:", err?.message ?? err);
     });
 }
 async function ensureTable() {
@@ -655,7 +676,7 @@ async function _doEnsureTable() {
         "updated_at",
         "expires_at",
     ]);
-    // `cleanupExpiredAgentScratchResources` filters on exactly these two columns
+    // `scheduleExpiredAgentScratchCleanup` filters on exactly these two columns
     // and, without this, full-scans `resources` — a table shared by every
     // template and read from agent discovery, docs, chat scratch and remote-agent
     // manifests. Its 60s throttle is a module-scope timestamp that starts at 0 in
@@ -669,7 +690,20 @@ async function _doEnsureTable() {
         // coercion-ok: absence of an index degrades latency, never correctness
         console.warn("[resources] could not ensure resources_visibility_expires_idx; scratch cleanup will full-scan:", err?.message ?? err);
     });
-    // Seed default shared resources if they don't exist (INSERT OR IGNORE to avoid race conditions)
+    // Seed default shared resources if they don't exist (INSERT OR IGNORE to avoid
+    // race conditions).
+    //
+    // Guarded by a durable marker: `_doEnsureTable` runs once per PROCESS, which on
+    // serverless is once per cold start, so this block was issuing ~10 writes and
+    // 2 migration scans per container to insert rows that had existed since day
+    // one (53,785 of them in one production sample). The marker makes it once per
+    // database, matching what the comments here already assumed.
+    //
+    // Consequence worth knowing: a default resource the user DELETES is no longer
+    // recreated on the next cold start. That silent resurrection was never
+    // intended — see `RESOURCE_SEED_VERSION` to force a re-seed.
+    if (await alreadySeeded(SHARED_SEED_KEY))
+        return;
     const now = Date.now();
     const seedSql = isPostgres()
         ? `INSERT INTO resources (id, path, owner, content, mime_type, size, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT (path, owner) DO NOTHING`
@@ -797,8 +831,54 @@ async function _doEnsureTable() {
     catch {
         // Migration best-effort
     }
+    await markSeeded(SHARED_SEED_KEY);
 }
+/**
+ * Bump when a default resource is ADDED, or when existing seed content must
+ * reach databases that already ran an earlier seed.
+ *
+ * The marker below records which version a database has been seeded at, so the
+ * seed runs once per database instead of once per process. Without a version, a
+ * newly added default would never reach an already-seeded deployment.
+ */
+const RESOURCE_SEED_VERSION = 1;
+/**
+ * Per-process memo ON TOP of the durable marker, so a warm process doesn't even
+ * pay the marker read. The durable marker is what makes this correct across cold
+ * starts; this only avoids a repeat lookup within one process.
+ */
 const _personalSeeded = new Set();
+function personalSeedKey(owner) {
+    return `resources-seeded:personal:v${RESOURCE_SEED_VERSION}:${owner.toLowerCase()}`;
+}
+const SHARED_SEED_KEY = `resources-seeded:shared:v${RESOURCE_SEED_VERSION}`;
+/**
+ * Has this database already been seeded at the current version?
+ *
+ * A failed marker read returns `false` — "seed again" — because the seeds are
+ * `ON CONFLICT DO NOTHING` and therefore idempotent. Guessing "already seeded"
+ * on an unreadable marker would skip seeding a fresh database and leave it
+ * without its default AGENTS.md / LEARNINGS.md, which is not recoverable by
+ * retrying a read.
+ */
+async function alreadySeeded(key) {
+    try {
+        const row = await getSetting(key);
+        return row?.at !== undefined;
+    }
+    catch {
+        // coercion-ok: "not seeded" is the SAFE answer, and it is not indistinguishable from success — it re-runs an idempotent ON CONFLICT DO NOTHING seed, exactly the pre-marker behaviour. Guessing "already seeded" would leave a fresh database permanently without its default AGENTS.md / LEARNINGS.md, which no retry recovers.
+        return false;
+    }
+}
+async function markSeeded(key) {
+    try {
+        await putSetting(key, { at: Date.now() });
+    }
+    catch {
+        // coercion-ok: the marker is an optimization, not state anything reads for correctness. Failing to write it costs one repeat idempotent seed on the next cold start — the pre-marker behaviour — and the seed itself already succeeded, so there is no failure to report to the caller.
+    }
+}
 /**
  * Seed personal AGENTS.md and LEARNINGS.md for a user if they don't exist.
  * Called when listing resources or from the agent chat plugin.
@@ -810,6 +890,14 @@ export async function ensurePersonalDefaults(owner) {
         return;
     }
     await ensureTable();
+    // The in-memory Set resets on every cold start, so on serverless this seed ran
+    // its 5 writes per container per owner, forever. The durable marker is what
+    // actually makes it once-per-owner.
+    const seedKey = personalSeedKey(owner);
+    if (await alreadySeeded(seedKey)) {
+        _personalSeeded.add(owner);
+        return;
+    }
     const client = getDbExec();
     const now = Date.now();
     const seedSql = isPostgres()
@@ -886,6 +974,7 @@ export async function ensurePersonalDefaults(owner) {
     // retries instead of permanently skipping seeding. Seeds use INSERT OR IGNORE
     // / ON CONFLICT DO NOTHING, so a concurrent re-run is harmless.
     _personalSeeded.add(owner);
+    await markSeeded(seedKey);
 }
 function rowToResource(row) {
     return {
@@ -932,7 +1021,7 @@ export async function resourceGet(id, options) {
         return localWorkspaceResourceById(id);
     }
     const client = getDbExec();
-    await cleanupExpiredAgentScratchResources(client);
+    scheduleExpiredAgentScratchCleanup(client);
     const { rows } = await client.execute({
         sql: `SELECT * FROM resources WHERE id = ?`,
         args: [id],
@@ -949,7 +1038,7 @@ export async function resourceGetByPath(owner, path, options) {
             return local;
     }
     const client = getDbExec();
-    await cleanupExpiredAgentScratchResources(client);
+    scheduleExpiredAgentScratchCleanup(client);
     const { rows } = await client.execute({
         sql: `SELECT * FROM resources WHERE owner = ? AND path = ?`,
         args: [owner, path],
@@ -1165,7 +1254,7 @@ export async function resourceDeleteByPath(owner, path) {
 export async function resourceList(owner, pathPrefix, options) {
     await ensureTable();
     const client = getDbExec();
-    await cleanupExpiredAgentScratchResources(client);
+    scheduleExpiredAgentScratchCleanup(client);
     const visibilitySql = scratchFilterSql(options);
     if (pathPrefix) {
         const { rows } = await client.execute({

package/dist/secrets/routes.d.ts

@@ -37,17 +37,17 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     ok?: undefined;
     status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
     ok?: undefined;
     error: string;
     removed?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
@@ -58,13 +58,13 @@ export declare function createTestSecretHandler(): import("h3").EventHandlerWith
     error: string;
     note?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-chat-plugin.js

@@ -117,6 +117,7 @@ import { isLocalhost, shouldBlockInProductCodeEditingSurface, } from "./agent-ch
 import { loadRunCodeToolEntries } from "./agent-chat/run-code-tools.js";
 import { createAgentEngineScriptEntries, createAgentLoopSettingsScriptEntries, createCallAgentScriptEntry, createChatScriptEntries, createDbScriptEntries, createDocsScriptEntries, createResourceScriptEntries, } from "./agent-chat/script-entries.js";
 import { parseSkillFrontmatter } from "./agent-chat/skill-frontmatter.js";
+import { shouldDisableInProcessSweeps } from "./sweep-runtime.js";
 export { loadResourcesForPrompt };
 export { _agentChatPromptSectionsForTests };
 export { buildPublicAgentA2ASkills };
@@ -4735,6 +4736,17 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             }));
             const isBackgroundRuntime = isInBackgroundFunctionRuntime();
             const disableRecurringJobsRuntime = isBackgroundRuntime || shouldDisableRecurringJobsRuntime();
+            // Opt-in kill switch for the backstop sweep timers below. On serverless
+            // these are billed per warm container, so their query rate scales with
+            // instance count rather than with anything happening. See
+            // `shouldDisableInProcessSweeps`.
+            const sweepsDisabled = shouldDisableInProcessSweeps();
+            if (sweepsDisabled) {
+                console.log("[agent-native] In-process backstop sweeps disabled " +
+                    "(AGENT_NATIVE_DISABLE_INPROCESS_SWEEPS). A durable scheduler must " +
+                    "drive automation redispatch, agent-teams reconciliation, and " +
+                    "sandbox-execution recovery, or queued work will not be retried.");
+            }
             // ─── Recurring Jobs Scheduler ──────────────────────────────────────
             // Poll every 60 seconds for due recurring jobs and execute them.
             // Uses setInterval so it works in all deployment environments without
@@ -4832,7 +4844,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // A non-Netlify self-dispatch only waits for the request to leave the
             // current invocation. Keep the durable history row as a retryable queue
             // so a frozen serverless handoff is recovered on the next sweep.
-            if (!isBackgroundRuntime) {
+            if (!isBackgroundRuntime && !sweepsDisabled) {
                 (() => {
                     let inFlight = false;
                     const sweep = async () => {
@@ -4864,7 +4876,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // per instance; cheap (one indexed query when no active tasks are found).
             // Throttled by the same per-owner interval guard inside reconcileAgentTeamRunsForOwner.
             (() => {
-                if (isBackgroundRuntime)
+                if (isBackgroundRuntime || sweepsDisabled)
                     return;
                 // Track when this instance last ran the sweep so only one sweep fires
                 // per 2-min window even if multiple timers fire in overlapping invocations.
@@ -5013,7 +5025,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // comment above for why this exists and the timing budget in
             // run-store.ts's `UNCLAIMED_BACKGROUND_RUN_FAST_SWEEP_MS` doc comment.
             (() => {
-                if (isBackgroundRuntime)
+                if (isBackgroundRuntime || sweepsDisabled)
                     return;
                 setTimeout(() => {
                     (async () => {
@@ -5056,7 +5068,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // still fails loud, and it survives the fast sweep having missed a row
             // entirely (e.g. a restart landed between fast-sweep ticks).
             (() => {
-                if (isBackgroundRuntime)
+                if (isBackgroundRuntime || sweepsDisabled)
                     return;
                 let lastSweep = 0;
                 const SWEEP_INTERVAL_MS = 2 * 60 * 1000;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/auth.d.ts

@@ -226,6 +226,9 @@ export declare function removeSession(token: string): Promise<void>;
 /**
  * Look up the email associated with a legacy session token.
  * Returns null if the session doesn't exist, is expired, or has no email.
+ *
+ * Resolutions are cached across requests — see `session-email-cache.ts` for the
+ * TTL and the only-cache-successes rule.
  */
 export declare function getSessionEmail(token: string): Promise<string | null>;
 export interface DesktopExchangeErrorPayload {

package/dist/server/auth.js

@@ -71,6 +71,7 @@ import { isIdentitySsoEnabled } from "./identity-sso-store.js";
 import { safeOAuthReturnUrl } from "./oauth-return-url.js";
 import { getOnboardingHtml, getResetPasswordHtml, } from "./onboarding-html.js";
 import { captureAuthError } from "./sentry.js";
+import { forgetCachedSessionEmail, getCachedSessionEmail, invalidateSessionEmailCache, setCachedSessionEmail, } from "./session-email-cache.js";
 import { isWorkspaceOAuthCallbackRelayEnabled } from "./workspace-oauth.js";
 /**
  * Get the configured session max age. Desktop SSO broker writes from
@@ -741,6 +742,9 @@ export async function addSession(token, email) {
             : `INSERT OR REPLACE INTO sessions (token, email, created_at) VALUES (?, ?, ?)`,
         args: [token, email ?? null, Date.now()],
     }));
+    // The upsert can REBIND an existing token to a different email, so a cached
+    // resolution for it is now wrong.
+    invalidateSessionEmailCache();
 }
 export async function hasLegacySessionForEmail(email) {
     await ensureSessionTable();
@@ -759,12 +763,20 @@ export async function removeSession(token) {
         sql: `DELETE FROM sessions WHERE token = ?`,
         args: [token],
     }));
+    // Sign-out must take effect immediately, not after the cache TTL.
+    invalidateSessionEmailCache();
 }
 /**
  * Look up the email associated with a legacy session token.
  * Returns null if the session doesn't exist, is expired, or has no email.
+ *
+ * Resolutions are cached across requests — see `session-email-cache.ts` for the
+ * TTL and the only-cache-successes rule.
  */
 export async function getSessionEmail(token) {
+    const cached = getCachedSessionEmail(token);
+    if (cached !== undefined)
+        return cached;
     await ensureSessionTable();
     const client = getDbExec();
     const { rows } = await retryIfSessionsMissing(() => client.execute({
@@ -779,9 +791,13 @@ export async function getSessionEmail(token) {
             sql: `DELETE FROM sessions WHERE token = ?`,
             args: [token],
         });
+        forgetCachedSessionEmail(token);
         return null;
     }
-    return rows[0].email ?? null;
+    const email = rows[0].email ?? null;
+    if (email)
+        setCachedSessionEmail(token, email);
+    return email;
 }
 // ---------------------------------------------------------------------------
 // getSession — the auth contract
@@ -937,6 +953,7 @@ async function consumeDesktopExchangeFromDB(flowId) {
             sql: `DELETE FROM sessions WHERE token = ? AND created_at > ? RETURNING email`,
             args: [`dex:${flowId}`, Date.now() - DESKTOP_EXCHANGE_TTL_MS],
         });
+        forgetCachedSessionEmail(`dex:${flowId}`);
         if (rows.length === 0)
             return null;
         const packed = (rows[0].email ?? rows[0][0]);
@@ -2706,6 +2723,9 @@ async function mountBetterAuthRoutes(app, options) {
                                 args: [userEmail],
                             });
                         }
+                        // Deleted by email, so the removed tokens are unknown here — the
+                        // whole cache goes.
+                        invalidateSessionEmailCache();
                     }
                 }
                 catch {
@@ -2939,6 +2959,7 @@ async function mountBetterAuthRoutes(app, options) {
             catch {
                 // Best-effort.
             }
+            invalidateSessionEmailCache();
             // 3. Drop the current request's cookie and best-effort sign out
             // of Better Auth (so the response sets the proper expiry header).
             clearFrameworkSessionCookies(event);

package/dist/server/collab-plugin.js

@@ -211,8 +211,12 @@ export function createCollabPlugin(options = {}) {
                         (action === "json" && method === "POST") ||
                         (action === "patch" && method === "POST");
                     if (isWrite) {
-                        // assertAccess throws ForbiddenError (→ 403) if no editor access
-                        const access = await assertAccess(resourceType, resourceId, "editor");
+                        // assertAccess throws ForbiddenError (→ 403) if no editor access.
+                        // Projected: only ownerEmail/orgId are read below, and a collab
+                        // resource's body is the largest column it has — loading it here
+                        // means every keystroke-driven update read the whole document
+                        // twice, once for the ACL and once for the edit itself.
+                        const access = await assertAccess(resourceType, resourceId, "editor", undefined, { skipResourceBody: true });
                         const resource = access.resource;
                         const awarenessScope = {
                             resourceType,
@@ -229,8 +233,10 @@ export function createCollabPlugin(options = {}) {
                         }
                     }
                     else {
-                        // resolveAccess returns null when no access; return 404 to avoid leaking existence
-                        const access = await resolveAccess(resourceType, resourceId);
+                        // resolveAccess returns null when no access; return 404 to avoid leaking existence.
+                        // Projected: only ownerEmail/orgId are read below, and a collab
+                        // resource's body is the largest column it has.
+                        const access = await resolveAccess(resourceType, resourceId, undefined, { skipResourceBody: true });
                         if (!access) {
                             setResponseStatus(event, 404);
                             return { error: "Not found" };

package/dist/server/core-routes-plugin.js

@@ -57,6 +57,7 @@ import { createPollHandler } from "./poll.js";
 import { createRealtimeTokenHandler } from "./realtime-token.js";
 import { getRequestContext, hasRequestContext, runWithRequestContext, } from "./request-context.js";
 import { findUnsupportedScopedKeyNames, saveKeyValuesToScopedSecrets, ScopedKeyStorageError, } from "./scoped-key-storage.js";
+import { shouldDisableInProcessSweeps } from "./sweep-runtime.js";
 import { createTranscribeVoiceHandler } from "./transcribe-voice.js";
 import { createVoiceProvidersStatusHandler } from "./voice-providers-status.js";
 import { createWorkspaceProviderOAuthHandler } from "./workspace-provider-oauth.js";
@@ -1260,6 +1261,8 @@ export function createCoreRoutesPlugin(options = {}) {
             // poll-time drain in run-code covers deployments where warm-instance
             // timers rarely fire.
             (() => {
+                if (shouldDisableInProcessSweeps())
+                    return;
                 let lastSweep = 0;
                 const SWEEP_INTERVAL_MS = 2 * 60 * 1000;
                 setTimeout(() => {

package/dist/server/session-email-cache.d.ts

@@ -0,0 +1,14 @@
+export declare function getCachedSessionEmail(token: string): string | undefined;
+export declare function setCachedSessionEmail(token: string, email: string): void;
+export declare function forgetCachedSessionEmail(token: string): void;
+/**
+ * Drop cached session resolutions. Call after ANY write to `sessions`.
+ *
+ * Clears every token rather than one: the bulk sign-out paths delete by email
+ * (`DELETE FROM sessions WHERE email = ?`) and do not know which tokens they
+ * removed, so a per-token eviction there would leave a signed-out session
+ * resolving for the rest of the TTL.
+ */
+export declare function invalidateSessionEmailCache(): void;
+/** Test seam — the cache is module state, so suites must be able to clear it. */
+export declare function __resetSessionEmailCacheForTests(): void;

package/dist/server/session-email-cache.js

@@ -0,0 +1,48 @@
+import { createTtlCache } from "../shared/ttl-cache.js";
+/**
+ * Cross-request cache for resolved legacy session tokens.
+ *
+ * A session token is immutable for its (30-day) lifetime, yet every
+ * authenticated request re-read it: production showed 494,848 of these for 3
+ * users, 1:1 with the request count. The TTL is far shorter than the session
+ * lifetime, so expiry is enforced at most `SESSION_EMAIL_TTL_MS` late — a 30-day
+ * boundary observed up to 15s late changes nothing.
+ *
+ * ONLY successful resolutions belong in here. A `null` — no such token, expired,
+ * revoked — must stay uncached so a sign-out or a token that has just been
+ * written is never answered from a stale negative, and so an auth failure can
+ * never be made sticky by a cache.
+ *
+ * Lives in its own module rather than in `auth.ts` because `auth.ts` imports
+ * `org/auth-policy.ts`, which also revokes sessions and so needs to invalidate
+ * this. Importing back into `auth.ts` from there would be a cycle.
+ */
+const SESSION_EMAIL_TTL_MS = 15_000;
+const sessionEmailCache = createTtlCache({
+    ttlMs: SESSION_EMAIL_TTL_MS,
+    maxEntries: 4_096,
+});
+export function getCachedSessionEmail(token) {
+    return sessionEmailCache.get(token);
+}
+export function setCachedSessionEmail(token, email) {
+    sessionEmailCache.set(token, email);
+}
+export function forgetCachedSessionEmail(token) {
+    sessionEmailCache.delete(token);
+}
+/**
+ * Drop cached session resolutions. Call after ANY write to `sessions`.
+ *
+ * Clears every token rather than one: the bulk sign-out paths delete by email
+ * (`DELETE FROM sessions WHERE email = ?`) and do not know which tokens they
+ * removed, so a per-token eviction there would leave a signed-out session
+ * resolving for the rest of the TTL.
+ */
+export function invalidateSessionEmailCache() {
+    sessionEmailCache.clear();
+}
+/** Test seam — the cache is module state, so suites must be able to clear it. */
+export function __resetSessionEmailCacheForTests() {
+    sessionEmailCache.clear();
+}

package/dist/server/sweep-runtime.d.ts

@@ -0,0 +1,22 @@
+type SweepRuntimeEnvKey = "AGENT_NATIVE_DISABLE_INPROCESS_SWEEPS";
+type SweepRuntimeEnv = Partial<Record<SweepRuntimeEnvKey, string | undefined>>;
+/**
+ * Kill switch for the `setInterval` backstop sweeps.
+ *
+ * These timers are correct on a long-lived Node server: one process, one timer
+ * set, one query per tick. On a serverless host they are billed per WARM
+ * CONTAINER, not per deployment — every warm instance independently runs the
+ * whole timer set, so the sweep query rate scales with instance count, which no
+ * in-process backoff or `lastSweep` guard can observe. A production sample
+ * showed one 2-minute sweep issuing 237k queries, implying ~11 containers each
+ * ticking forever against a database that then never gets to autosuspend.
+ *
+ * Default OFF (sweeps run), because on every host where the timers are the only
+ * thing driving recovery, disabling them silently strands queued work. Turn this
+ * on ONLY where a durable platform scheduler already drives the same recovery —
+ * the shape `isNetlifyRecurringJobsRuntime` + the emitted scheduled sweep
+ * already implement for recurring jobs, and which these three sweeps should
+ * eventually adopt instead of needing this switch at all.
+ */
+export declare function shouldDisableInProcessSweeps(env?: SweepRuntimeEnv): boolean;
+export {};

package/dist/server/sweep-runtime.js

@@ -0,0 +1,28 @@
+// ---------------------------------------------------------------------------
+// Gating for the in-process backstop sweep timers (automation redispatch,
+// agent-teams orphan reconciliation, durable sandbox executions).
+// ---------------------------------------------------------------------------
+function isTruthyEnv(value) {
+    return /^(1|true|yes|on)$/i.test(value?.trim() ?? "");
+}
+/**
+ * Kill switch for the `setInterval` backstop sweeps.
+ *
+ * These timers are correct on a long-lived Node server: one process, one timer
+ * set, one query per tick. On a serverless host they are billed per WARM
+ * CONTAINER, not per deployment — every warm instance independently runs the
+ * whole timer set, so the sweep query rate scales with instance count, which no
+ * in-process backoff or `lastSweep` guard can observe. A production sample
+ * showed one 2-minute sweep issuing 237k queries, implying ~11 containers each
+ * ticking forever against a database that then never gets to autosuspend.
+ *
+ * Default OFF (sweeps run), because on every host where the timers are the only
+ * thing driving recovery, disabling them silently strands queued work. Turn this
+ * on ONLY where a durable platform scheduler already drives the same recovery —
+ * the shape `isNetlifyRecurringJobsRuntime` + the emitted scheduled sweep
+ * already implement for recurring jobs, and which these three sweeps should
+ * eventually adopt instead of needing this switch at all.
+ */
+export function shouldDisableInProcessSweeps(env = process.env) {
+    return isTruthyEnv(env.AGENT_NATIVE_DISABLE_INPROCESS_SWEEPS);
+}

package/dist/settings/store.js

@@ -25,6 +25,24 @@ function requestSettingsCache() {
     }
     return cache;
 }
+/**
+ * Per-request memo of the WHOLE settings table for `getAllSettings`.
+ *
+ * The single-key path above was already request-cached; the full-table read was
+ * not, and production showed 98,479 of them — an entire `SELECT key, value FROM
+ * settings` per call, several times per request via the MCP client routes and
+ * org settings.
+ *
+ * Holds raw JSON strings, like the single-key cache, so callers can't mutate a
+ * shared parsed object. Dropped by every write path, because a request that
+ * writes a setting and then re-reads all of them must see its own write.
+ */
+const _requestAllSettingsCache = new WeakMap();
+function invalidateRequestAllSettings() {
+    const ctx = getRequestContext();
+    if (ctx && typeof ctx === "object")
+        _requestAllSettingsCache.delete(ctx);
+}
 // Created lazily so this module can be evaluated in the browser dev graph
 // without a top-level `new EventEmitter()` tripping Vite's externalized
 // `node:events` stub. The emitter drives server-side SSE fan-out only.
@@ -152,6 +170,7 @@ export async function mutateSetting(key, updater, options) {
         if (result.rowsAffected === 0)
             continue;
         requestSettingsCache()?.set(key, nextRaw);
+        invalidateRequestAllSettings();
         settingsEmitter().emit("settings", {
             source: "settings",
             type: "change",
@@ -173,6 +192,7 @@ export async function putSetting(key, value, options) {
         args: [key, JSON.stringify(value), Date.now()],
     });
     requestSettingsCache()?.set(key, JSON.stringify(value));
+    invalidateRequestAllSettings();
     settingsEmitter().emit("settings", {
         source: "settings",
         type: "change",
@@ -189,6 +209,7 @@ export async function deleteSetting(key, options) {
         args: [key],
     });
     requestSettingsCache()?.set(key, null);
+    invalidateRequestAllSettings();
     if (result.rowsAffected > 0) {
         settingsEmitter().emit("settings", {
             source: "settings",
@@ -215,6 +236,7 @@ export async function deleteSettingsByPrefix(prefix, options) {
         args: [`${escaped}%`],
     });
     requestSettingsCache()?.clear();
+    invalidateRequestAllSettings();
     if (result.rowsAffected > 0) {
         settingsEmitter().emit("settings", {
             source: "settings",
@@ -226,13 +248,47 @@ export async function deleteSettingsByPrefix(prefix, options) {
     return result.rowsAffected;
 }
 export async function getAllSettings() {
-    await ensureTable();
-    const client = getDbExec();
-    const table = settingsTable();
-    const { rows } = await client.execute(`SELECT key, value FROM ${table}`);
+    const raw = await loadAllSettingsRaw();
     const result = {};
-    for (const row of rows) {
-        result[row.key] = JSON.parse(row.value);
-    }
+    for (const [key, value] of raw)
+        result[key] = JSON.parse(value);
     return result;
 }
+async function loadAllSettingsRaw() {
+    const ctx = getRequestContext();
+    const cached = ctx && typeof ctx === "object"
+        ? _requestAllSettingsCache.get(ctx)
+        : undefined;
+    if (cached)
+        return cached;
+    const load = (async () => {
+        await ensureTable();
+        const client = getDbExec();
+        const table = settingsTable();
+        const { rows } = await client.execute(`SELECT key, value FROM ${table}`);
+        const raw = new Map();
+        for (const row of rows)
+            raw.set(row.key, row.value);
+        // Seed the single-key cache so a `getSetting` after `getAllSettings` in the
+        // same request is free rather than another round trip. Only fills keys it
+        // does not already hold: a value written earlier in this request is already
+        // written through there and must win over this snapshot.
+        const perKey = requestSettingsCache();
+        if (perKey) {
+            for (const [key, value] of raw) {
+                if (!perKey.has(key))
+                    perKey.set(key, value);
+            }
+        }
+        return raw;
+    })();
+    if (ctx && typeof ctx === "object") {
+        // Evicted on failure so one transient error is not memoized as the answer
+        // for the rest of the request.
+        _requestAllSettingsCache.set(ctx, load.catch((err) => {
+            _requestAllSettingsCache.delete(ctx);
+            throw err;
+        }));
+    }
+    return load;
+}