@agent-native/core 0.145.0 → 0.145.2

package/dist/resources/store.js

@@ -4,6 +4,7 @@ import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../db
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 import { canUseLocalWorkspaceResourcePath, deleteLocalWorkspaceResource, isLocalWorkspaceResourceId, isLocalWorkspaceResourcesEnabled, listLocalWorkspaceResources, localWorkspaceResourcePathFromId, readLocalWorkspaceResource, writeLocalWorkspaceResource, } from "../local-artifacts/index.js";
 import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
+import { getSetting, putSetting, } from "../settings/store.js";
 import { emitResourceChange, emitResourceDelete } from "./emitter.js";
 export const SHARED_OWNER = "__shared__";
 export const WORKSPACE_OWNER = "__workspace__";
@@ -570,14 +571,34 @@ async function grantedWorkspaceResourceByPath(path, options) {
         return null;
     }
 }
-async function cleanupExpiredAgentScratchResources(client) {
+/**
+ * Expire agent scratch resources, WITHOUT blocking the read that triggered it.
+ *
+ * This is garbage collection, not part of any read's answer: a caller asking for
+ * one resource does not need yesterday's expired scratch rows gone first. Awaiting
+ * it made every read path issue a `DELETE` before its own `SELECT` — double the
+ * round trips, unservable by a replica, taking row locks inside a request a user
+ * is waiting on, and (since nothing caught it) able to fail the read outright.
+ *
+ * The throttle is a module-scope timestamp, so it starts at 0 in a fresh isolate
+ * and the first resource read after every cold start still triggers one sweep.
+ * That is why the index below exists, and why this must not be awaited.
+ */
+function scheduleExpiredAgentScratchCleanup(client) {
     const now = Date.now();
     if (now - _lastScratchCleanupAt < SCRATCH_CLEANUP_INTERVAL_MS)
         return;
     _lastScratchCleanupAt = now;
-    await client.execute({
+    void client
+        .execute({
         sql: `DELETE FROM resources WHERE visibility = ? AND expires_at IS NOT NULL AND expires_at <= ?`,
         args: ["agent_scratch", now],
+    })
+        .catch((err) => {
+        // Say so rather than swallowing: scratch rows accumulating forever is a
+        // slow leak nobody would otherwise notice.
+        // coercion-ok: failed GC degrades storage over time, never read correctness
+        console.warn("[resources] expired agent-scratch cleanup failed; will retry on a later read:", err?.message ?? err);
     });
 }
 async function ensureTable() {
@@ -655,7 +676,7 @@ async function _doEnsureTable() {
         "updated_at",
         "expires_at",
     ]);
-    // `cleanupExpiredAgentScratchResources` filters on exactly these two columns
+    // `scheduleExpiredAgentScratchCleanup` filters on exactly these two columns
     // and, without this, full-scans `resources` — a table shared by every
     // template and read from agent discovery, docs, chat scratch and remote-agent
     // manifests. Its 60s throttle is a module-scope timestamp that starts at 0 in
@@ -669,7 +690,20 @@ async function _doEnsureTable() {
         // coercion-ok: absence of an index degrades latency, never correctness
         console.warn("[resources] could not ensure resources_visibility_expires_idx; scratch cleanup will full-scan:", err?.message ?? err);
     });
-    // Seed default shared resources if they don't exist (INSERT OR IGNORE to avoid race conditions)
+    // Seed default shared resources if they don't exist (INSERT OR IGNORE to avoid
+    // race conditions).
+    //
+    // Guarded by a durable marker: `_doEnsureTable` runs once per PROCESS, which on
+    // serverless is once per cold start, so this block was issuing ~10 writes and
+    // 2 migration scans per container to insert rows that had existed since day
+    // one (53,785 of them in one production sample). The marker makes it once per
+    // database, matching what the comments here already assumed.
+    //
+    // Consequence worth knowing: a default resource the user DELETES is no longer
+    // recreated on the next cold start. That silent resurrection was never
+    // intended — see `RESOURCE_SEED_VERSION` to force a re-seed.
+    if (await alreadySeeded(SHARED_SEED_KEY))
+        return;
     const now = Date.now();
     const seedSql = isPostgres()
         ? `INSERT INTO resources (id, path, owner, content, mime_type, size, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT (path, owner) DO NOTHING`
@@ -797,8 +831,54 @@ async function _doEnsureTable() {
     catch {
         // Migration best-effort
     }
+    await markSeeded(SHARED_SEED_KEY);
 }
+/**
+ * Bump when a default resource is ADDED, or when existing seed content must
+ * reach databases that already ran an earlier seed.
+ *
+ * The marker below records which version a database has been seeded at, so the
+ * seed runs once per database instead of once per process. Without a version, a
+ * newly added default would never reach an already-seeded deployment.
+ */
+const RESOURCE_SEED_VERSION = 1;
+/**
+ * Per-process memo ON TOP of the durable marker, so a warm process doesn't even
+ * pay the marker read. The durable marker is what makes this correct across cold
+ * starts; this only avoids a repeat lookup within one process.
+ */
 const _personalSeeded = new Set();
+function personalSeedKey(owner) {
+    return `resources-seeded:personal:v${RESOURCE_SEED_VERSION}:${owner.toLowerCase()}`;
+}
+const SHARED_SEED_KEY = `resources-seeded:shared:v${RESOURCE_SEED_VERSION}`;
+/**
+ * Has this database already been seeded at the current version?
+ *
+ * A failed marker read returns `false` — "seed again" — because the seeds are
+ * `ON CONFLICT DO NOTHING` and therefore idempotent. Guessing "already seeded"
+ * on an unreadable marker would skip seeding a fresh database and leave it
+ * without its default AGENTS.md / LEARNINGS.md, which is not recoverable by
+ * retrying a read.
+ */
+async function alreadySeeded(key) {
+    try {
+        const row = await getSetting(key);
+        return row?.at !== undefined;
+    }
+    catch {
+        // coercion-ok: "not seeded" is the SAFE answer, and it is not indistinguishable from success — it re-runs an idempotent ON CONFLICT DO NOTHING seed, exactly the pre-marker behaviour. Guessing "already seeded" would leave a fresh database permanently without its default AGENTS.md / LEARNINGS.md, which no retry recovers.
+        return false;
+    }
+}
+async function markSeeded(key) {
+    try {
+        await putSetting(key, { at: Date.now() });
+    }
+    catch {
+        // coercion-ok: the marker is an optimization, not state anything reads for correctness. Failing to write it costs one repeat idempotent seed on the next cold start — the pre-marker behaviour — and the seed itself already succeeded, so there is no failure to report to the caller.
+    }
+}
 /**
  * Seed personal AGENTS.md and LEARNINGS.md for a user if they don't exist.
  * Called when listing resources or from the agent chat plugin.
@@ -810,6 +890,14 @@ export async function ensurePersonalDefaults(owner) {
         return;
     }
     await ensureTable();
+    // The in-memory Set resets on every cold start, so on serverless this seed ran
+    // its 5 writes per container per owner, forever. The durable marker is what
+    // actually makes it once-per-owner.
+    const seedKey = personalSeedKey(owner);
+    if (await alreadySeeded(seedKey)) {
+        _personalSeeded.add(owner);
+        return;
+    }
     const client = getDbExec();
     const now = Date.now();
     const seedSql = isPostgres()
@@ -886,6 +974,7 @@ export async function ensurePersonalDefaults(owner) {
     // retries instead of permanently skipping seeding. Seeds use INSERT OR IGNORE
     // / ON CONFLICT DO NOTHING, so a concurrent re-run is harmless.
     _personalSeeded.add(owner);
+    await markSeeded(seedKey);
 }
 function rowToResource(row) {
     return {
@@ -932,7 +1021,7 @@ export async function resourceGet(id, options) {
         return localWorkspaceResourceById(id);
     }
     const client = getDbExec();
-    await cleanupExpiredAgentScratchResources(client);
+    scheduleExpiredAgentScratchCleanup(client);
     const { rows } = await client.execute({
         sql: `SELECT * FROM resources WHERE id = ?`,
         args: [id],
@@ -949,7 +1038,7 @@ export async function resourceGetByPath(owner, path, options) {
             return local;
     }
     const client = getDbExec();
-    await cleanupExpiredAgentScratchResources(client);
+    scheduleExpiredAgentScratchCleanup(client);
     const { rows } = await client.execute({
         sql: `SELECT * FROM resources WHERE owner = ? AND path = ?`,
         args: [owner, path],
@@ -1165,7 +1254,7 @@ export async function resourceDeleteByPath(owner, path) {
 export async function resourceList(owner, pathPrefix, options) {
     await ensureTable();
     const client = getDbExec();
-    await cleanupExpiredAgentScratchResources(client);
+    scheduleExpiredAgentScratchCleanup(client);
     const visibilitySql = scratchFilterSql(options);
     if (pathPrefix) {
         const { rows } = await client.execute({

package/dist/secrets/routes.d.ts

@@ -37,17 +37,17 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     ok?: undefined;
     status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
     ok?: undefined;
     error: string;
     removed?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
@@ -58,13 +58,13 @@ export declare function createTestSecretHandler(): import("h3").EventHandlerWith
     error: string;
     note?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-chat-plugin.js

@@ -11,6 +11,7 @@ import { DEFAULT_ANTHROPIC_MODEL } from "../agent/default-model.js";
 import { AGENT_CHAT_BACKGROUND_RUN_FIELD, AGENT_CHAT_PROCESS_RUN_PATH, backgroundRunMarkerExpectsBackgroundRuntime, isInBackgroundFunctionRuntime, prepareProcessRunRequest, } from "../agent/durable-background.js";
 import { resolveEngine, createAnthropicEngine, getStoredModelForEngine, normalizeModelForEngine, resolveDelegatedRunModel, getAgentEngineEntry, isAgentEnginePackageInstalled, isStoredEngineUsableForRequest, listAgentEngines, registerBuiltinEngines, } from "../agent/engine/index.js";
 import { SYSTEM_PROMPT_CACHE_SPLIT } from "../agent/engine/prompt-cache.js";
+import { PROVIDER_TO_ENV } from "../agent/engine/provider-env-vars.js";
 import { createProductionAgentHandler, actionsToEngineTools, executeAgentToolCall, toolCallCacheKey, getActiveRunForThreadAsync, abortRunDurably, abortTurnDurably, subscribeToRun, } from "../agent/production-agent.js";
 import { callerHasRunAccess, callerHasThreadAccess, } from "../agent/run-ownership.js";
 import { markTurnAborted, readBackgroundRunClaim } from "../agent/run-store.js";
@@ -117,6 +118,7 @@ import { isLocalhost, shouldBlockInProductCodeEditingSurface, } from "./agent-ch
 import { loadRunCodeToolEntries } from "./agent-chat/run-code-tools.js";
 import { createAgentEngineScriptEntries, createAgentLoopSettingsScriptEntries, createCallAgentScriptEntry, createChatScriptEntries, createDbScriptEntries, createDocsScriptEntries, createResourceScriptEntries, } from "./agent-chat/script-entries.js";
 import { parseSkillFrontmatter } from "./agent-chat/skill-frontmatter.js";
+import { shouldDisableInProcessSweeps } from "./sweep-runtime.js";
 export { loadResourcesForPrompt };
 export { _agentChatPromptSectionsForTests };
 export { buildPublicAgentA2ASkills };
@@ -1239,8 +1241,12 @@ export function createAgentChatPlugin(options) {
                     }
                     // Use the SAME agent setup as the interactive chat — identical tools,
                     // prompt, and capabilities. The A2A agent IS the app's agent.
-                    const { getOwnerActiveApiKey } = await import("../agent/production-agent.js");
-                    const ownerApiKey = await getOwnerActiveApiKey(userEmail);
+                    const { resolveOwnerEngineApiKey } = await import("../agent/production-agent.js");
+                    const { apiKey: ownerApiKey, apiKeyEnvVar: ownerApiKeyEnvVar } = await resolveOwnerEngineApiKey({
+                        engineOption: options?.engine,
+                        ownerEmail: userEmail,
+                        anthropicFallback: options?.apiKey,
+                    });
                     // A2A runs are reconstructed in a fresh processor request, so they
                     // do not pass through the interactive handler's prepareRun hook.
                     // Seed the same mutable run context before resolving the engine and
@@ -1253,6 +1259,7 @@ export function createAgentChatPlugin(options) {
                     if (a2aRunContext) {
                         a2aRunContext.owner = userEmail;
                         a2aRunContext.userApiKey = ownerApiKey;
+                        a2aRunContext.userApiKeyEnvVar = ownerApiKeyEnvVar;
                         // The async processor restores the original request origin from
                         // task metadata. Only derive a fallback for synchronous A2A calls
                         // where the inbound event is still the caller request.
@@ -1273,7 +1280,8 @@ export function createAgentChatPlugin(options) {
                     }
                     const a2aEngine = await resolveEngine({
                         engineOption: options?.engine,
-                        apiKey: ownerApiKey ?? options?.apiKey,
+                        apiKey: ownerApiKey,
+                        apiKeyEnvVar: ownerApiKeyEnvVar,
                         appId: options?.appId,
                     });
                     const devActive = isDevMode();
@@ -1683,13 +1691,27 @@ export function createAgentChatPlugin(options) {
                     askAgent: async (message) => {
                         const ownerEmail = getRequestUserEmail();
                         const mcpRunId = crypto.randomUUID();
-                        const { getOwnerActiveApiKey } = await import("../agent/production-agent.js");
-                        const ownerApiKey = ownerEmail
-                            ? await getOwnerActiveApiKey(ownerEmail)
-                            : undefined;
+                        const { resolveOwnerEngineApiKey } = await import("../agent/production-agent.js");
+                        const ownerApiKey = await resolveOwnerEngineApiKey({
+                            engineOption: options?.engine,
+                            ownerEmail,
+                            anthropicFallback: options?.apiKey,
+                        });
+                        // `ask_app` runs outside the interactive handler, so nothing seeds
+                        // the run context for it — and `onEngineResolved` never fires on
+                        // this path either. Without the resolved key and its provenance
+                        // here, an agent-team sub-agent spawned from an MCP run falls back
+                        // to the plugin host key while the parent bills the owner's BYO
+                        // credential. Same reason the A2A branch above seeds it.
+                        const mcpRunContext = ensureRequestRunContext();
+                        if (mcpRunContext) {
+                            mcpRunContext.userApiKey = ownerApiKey.apiKey;
+                            mcpRunContext.userApiKeyEnvVar = ownerApiKey.apiKeyEnvVar;
+                        }
                         const mcpEngine = await resolveEngine({
                             engineOption: options?.engine,
-                            apiKey: ownerApiKey ?? options?.apiKey,
+                            apiKey: ownerApiKey.apiKey,
+                            apiKeyEnvVar: ownerApiKey.apiKeyEnvVar,
                             appId: options?.appId,
                         });
                         const mcpModelCandidate = options?.model ??
@@ -2179,12 +2201,19 @@ export function createAgentChatPlugin(options) {
                 getActions: buildSubAgentActions,
                 getEngine: () => {
                     const runCtx = getRequestRunContext();
+                    // Sub-agents must inherit the parent run's resolved key so
+                    // delegations spawned by agent-teams don't silently fall back to
+                    // the platform key while the parent uses BYO credentials. This
+                    // fallback engine is Anthropic, so a key the parent resolved for
+                    // another provider is not inheritable — passing it anyway sends a
+                    // live OpenAI/Gemini secret to Anthropic's endpoint.
+                    const inheritableKey = runCtx?.userApiKeyEnvVar === undefined ||
+                        runCtx.userApiKeyEnvVar === "ANTHROPIC_API_KEY"
+                        ? runCtx?.userApiKey
+                        : undefined;
                     return (runCtx?.engine ??
                         createAnthropicEngine({
-                            // Sub-agents must inherit the parent run's resolved key so
-                            // delegations spawned by agent-teams don't silently fall back
-                            // to the platform key while the parent uses BYO credentials.
-                            apiKey: runCtx?.userApiKey ?? options?.apiKey,
+                            apiKey: inheritableKey ?? options?.apiKey,
                         }));
                 },
                 getModel: () => getRequestRunContext()?.model ?? resolvedModel,
@@ -2341,13 +2370,17 @@ export function createAgentChatPlugin(options) {
             // content is what the token-saving modes strip.
             const prepareRun = async (event) => {
                 const owner = await getOwnerFromEvent(event);
-                const { getOwnerActiveApiKey } = await import("../agent/production-agent.js");
-                const userApiKey = await getOwnerActiveApiKey(owner);
+                const { resolveOwnerEngineApiKey } = await import("../agent/production-agent.js");
+                const userApiKey = await resolveOwnerEngineApiKey({
+                    engineOption: options?.engine,
+                    ownerEmail: owner,
+                });
                 const runCtx = ensureRequestRunContext();
                 if (runCtx) {
                     runCtx.requestOrigin = getOrigin(event);
                     runCtx.owner = owner;
-                    runCtx.userApiKey = userApiKey;
+                    runCtx.userApiKey = userApiKey.apiKey;
+                    runCtx.userApiKeyEnvVar = userApiKey.apiKeyEnvVar;
                 }
                 const extra = await resolveExtraContext(event, owner);
                 return { owner, extra };
@@ -2937,21 +2970,28 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         resolveConfig: async ({ payload, ownerEmail, orgId: _orgId }) => {
                             // Resolve the owner's API key so BYO-key sub-agents use the
                             // same credentials as the parent chat.
-                            let apiKey;
+                            let resolvedKey = {
+                                apiKey: undefined,
+                                apiKeyEnvVar: undefined,
+                            };
                             try {
-                                const { getOwnerActiveApiKey } = await import("../agent/production-agent.js");
-                                apiKey =
-                                    (await getOwnerActiveApiKey(ownerEmail)) ?? undefined;
+                                const { resolveOwnerEngineApiKey } = await import("../agent/production-agent.js");
+                                resolvedKey = await resolveOwnerEngineApiKey({
+                                    engineOption: options?.engine,
+                                    ownerEmail,
+                                    anthropicFallback: options?.apiKey,
+                                });
                             }
                             catch {
-                                apiKey = undefined;
+                                resolvedKey = { apiKey: undefined, apiKeyEnvVar: undefined };
                             }
                             // Use the same resolveEngine path as the A2A and MCP
                             // processors so Builder-gateway/OpenAI users get their
                             // configured engine instead of always hitting the Anthropic SDK.
                             const engine = await resolveEngine({
                                 engineOption: options?.engine,
-                                apiKey: apiKey ?? options?.apiKey,
+                                apiKey: resolvedKey.apiKey,
+                                apiKeyEnvVar: resolvedKey.apiKeyEnvVar,
                                 appId: options?.appId,
                             });
                             const modelCandidate = payload.model ??
@@ -3147,15 +3187,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     setResponseStatus(event, 401);
                     return { error: "Authentication required" };
                 }
-                const providerToEnv = {
-                    anthropic: "ANTHROPIC_API_KEY",
-                    openai: "OPENAI_API_KEY",
-                    google: "GOOGLE_GENERATIVE_AI_API_KEY",
-                    groq: "GROQ_API_KEY",
-                    mistral: "MISTRAL_API_KEY",
-                    cohere: "COHERE_API_KEY",
-                };
-                const secretKey = providerToEnv[provider] ?? `${provider.toUpperCase()}_API_KEY`;
+                const secretKey = PROVIDER_TO_ENV[provider] ?? `${provider.toUpperCase()}_API_KEY`;
                 try {
                     const { writeAppSecret } = await import("../secrets/storage.js");
                     await writeAppSecret({
@@ -3685,9 +3717,12 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     .trim();
                 // Mirror the chat-run resolution so BYO-key users have title
                 // generation billed to their own key instead of the platform key.
-                const { getOwnerActiveApiKey } = await import("../agent/production-agent.js");
-                const userApiKey = await getOwnerActiveApiKey(ownerEmail);
-                const apiKey = userApiKey;
+                // This request goes straight to Anthropic, so it needs the owner's
+                // Anthropic key specifically — the active engine may be another
+                // provider, whose key must never be sent here. Owners without one
+                // get the truncated title.
+                const { getOwnerApiKeyForEngine } = await import("../agent/production-agent.js");
+                const { apiKey } = await getOwnerApiKeyForEngine("anthropic", ownerEmail);
                 if (!apiKey) {
                     // Fallback: truncate the message
                     return { title: cleanMessage.trim().slice(0, 60) };
@@ -4735,6 +4770,17 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             }));
             const isBackgroundRuntime = isInBackgroundFunctionRuntime();
             const disableRecurringJobsRuntime = isBackgroundRuntime || shouldDisableRecurringJobsRuntime();
+            // Opt-in kill switch for the backstop sweep timers below. On serverless
+            // these are billed per warm container, so their query rate scales with
+            // instance count rather than with anything happening. See
+            // `shouldDisableInProcessSweeps`.
+            const sweepsDisabled = shouldDisableInProcessSweeps();
+            if (sweepsDisabled) {
+                console.log("[agent-native] In-process backstop sweeps disabled " +
+                    "(AGENT_NATIVE_DISABLE_INPROCESS_SWEEPS). A durable scheduler must " +
+                    "drive automation redispatch, agent-teams reconciliation, and " +
+                    "sandbox-execution recovery, or queued work will not be retried.");
+            }
             // ─── Recurring Jobs Scheduler ──────────────────────────────────────
             // Poll every 60 seconds for due recurring jobs and execute them.
             // Uses setInterval so it works in all deployment environments without
@@ -4832,7 +4878,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // A non-Netlify self-dispatch only waits for the request to leave the
             // current invocation. Keep the durable history row as a retryable queue
             // so a frozen serverless handoff is recovered on the next sweep.
-            if (!isBackgroundRuntime) {
+            if (!isBackgroundRuntime && !sweepsDisabled) {
                 (() => {
                     let inFlight = false;
                     const sweep = async () => {
@@ -4864,7 +4910,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // per instance; cheap (one indexed query when no active tasks are found).
             // Throttled by the same per-owner interval guard inside reconcileAgentTeamRunsForOwner.
             (() => {
-                if (isBackgroundRuntime)
+                if (isBackgroundRuntime || sweepsDisabled)
                     return;
                 // Track when this instance last ran the sweep so only one sweep fires
                 // per 2-min window even if multiple timers fire in overlapping invocations.
@@ -5013,7 +5059,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // comment above for why this exists and the timing budget in
             // run-store.ts's `UNCLAIMED_BACKGROUND_RUN_FAST_SWEEP_MS` doc comment.
             (() => {
-                if (isBackgroundRuntime)
+                if (isBackgroundRuntime || sweepsDisabled)
                     return;
                 setTimeout(() => {
                     (async () => {
@@ -5056,7 +5102,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // still fails loud, and it survives the fast sweep having missed a row
             // entirely (e.g. a restart landed between fast-sweep ticks).
             (() => {
-                if (isBackgroundRuntime)
+                if (isBackgroundRuntime || sweepsDisabled)
                     return;
                 let lastSweep = 0;
                 const SWEEP_INTERVAL_MS = 2 * 60 * 1000;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/auth.d.ts

@@ -226,6 +226,9 @@ export declare function removeSession(token: string): Promise<void>;
 /**
  * Look up the email associated with a legacy session token.
  * Returns null if the session doesn't exist, is expired, or has no email.
+ *
+ * Resolutions are cached across requests — see `session-email-cache.ts` for the
+ * TTL and the only-cache-successes rule.
  */
 export declare function getSessionEmail(token: string): Promise<string | null>;
 export interface DesktopExchangeErrorPayload {

package/dist/server/auth.js

@@ -71,6 +71,7 @@ import { isIdentitySsoEnabled } from "./identity-sso-store.js";
 import { safeOAuthReturnUrl } from "./oauth-return-url.js";
 import { getOnboardingHtml, getResetPasswordHtml, } from "./onboarding-html.js";
 import { captureAuthError } from "./sentry.js";
+import { forgetCachedSessionEmail, getCachedSessionEmail, invalidateSessionEmailCache, setCachedSessionEmail, } from "./session-email-cache.js";
 import { isWorkspaceOAuthCallbackRelayEnabled } from "./workspace-oauth.js";
 /**
  * Get the configured session max age. Desktop SSO broker writes from
@@ -741,6 +742,9 @@ export async function addSession(token, email) {
             : `INSERT OR REPLACE INTO sessions (token, email, created_at) VALUES (?, ?, ?)`,
         args: [token, email ?? null, Date.now()],
     }));
+    // The upsert can REBIND an existing token to a different email, so a cached
+    // resolution for it is now wrong.
+    invalidateSessionEmailCache();
 }
 export async function hasLegacySessionForEmail(email) {
     await ensureSessionTable();
@@ -759,12 +763,20 @@ export async function removeSession(token) {
         sql: `DELETE FROM sessions WHERE token = ?`,
         args: [token],
     }));
+    // Sign-out must take effect immediately, not after the cache TTL.
+    invalidateSessionEmailCache();
 }
 /**
  * Look up the email associated with a legacy session token.
  * Returns null if the session doesn't exist, is expired, or has no email.
+ *
+ * Resolutions are cached across requests — see `session-email-cache.ts` for the
+ * TTL and the only-cache-successes rule.
  */
 export async function getSessionEmail(token) {
+    const cached = getCachedSessionEmail(token);
+    if (cached !== undefined)
+        return cached;
     await ensureSessionTable();
     const client = getDbExec();
     const { rows } = await retryIfSessionsMissing(() => client.execute({
@@ -779,9 +791,13 @@ export async function getSessionEmail(token) {
             sql: `DELETE FROM sessions WHERE token = ?`,
             args: [token],
         });
+        forgetCachedSessionEmail(token);
         return null;
     }
-    return rows[0].email ?? null;
+    const email = rows[0].email ?? null;
+    if (email)
+        setCachedSessionEmail(token, email);
+    return email;
 }
 // ---------------------------------------------------------------------------
 // getSession — the auth contract
@@ -937,6 +953,7 @@ async function consumeDesktopExchangeFromDB(flowId) {
             sql: `DELETE FROM sessions WHERE token = ? AND created_at > ? RETURNING email`,
             args: [`dex:${flowId}`, Date.now() - DESKTOP_EXCHANGE_TTL_MS],
         });
+        forgetCachedSessionEmail(`dex:${flowId}`);
         if (rows.length === 0)
             return null;
         const packed = (rows[0].email ?? rows[0][0]);
@@ -2706,6 +2723,9 @@ async function mountBetterAuthRoutes(app, options) {
                                 args: [userEmail],
                             });
                         }
+                        // Deleted by email, so the removed tokens are unknown here — the
+                        // whole cache goes.
+                        invalidateSessionEmailCache();
                     }
                 }
                 catch {
@@ -2939,6 +2959,7 @@ async function mountBetterAuthRoutes(app, options) {
             catch {
                 // Best-effort.
             }
+            invalidateSessionEmailCache();
             // 3. Drop the current request's cookie and best-effort sign out
             // of Better Auth (so the response sets the proper expiry header).
             clearFrameworkSessionCookies(event);

package/dist/server/collab-plugin.js

@@ -211,8 +211,12 @@ export function createCollabPlugin(options = {}) {
                         (action === "json" && method === "POST") ||
                         (action === "patch" && method === "POST");
                     if (isWrite) {
-                        // assertAccess throws ForbiddenError (→ 403) if no editor access
-                        const access = await assertAccess(resourceType, resourceId, "editor");
+                        // assertAccess throws ForbiddenError (→ 403) if no editor access.
+                        // Projected: only ownerEmail/orgId are read below, and a collab
+                        // resource's body is the largest column it has — loading it here
+                        // means every keystroke-driven update read the whole document
+                        // twice, once for the ACL and once for the edit itself.
+                        const access = await assertAccess(resourceType, resourceId, "editor", undefined, { skipResourceBody: true });
                         const resource = access.resource;
                         const awarenessScope = {
                             resourceType,
@@ -229,8 +233,10 @@ export function createCollabPlugin(options = {}) {
                         }
                     }
                     else {
-                        // resolveAccess returns null when no access; return 404 to avoid leaking existence
-                        const access = await resolveAccess(resourceType, resourceId);
+                        // resolveAccess returns null when no access; return 404 to avoid leaking existence.
+                        // Projected: only ownerEmail/orgId are read below, and a collab
+                        // resource's body is the largest column it has.
+                        const access = await resolveAccess(resourceType, resourceId, undefined, { skipResourceBody: true });
                         if (!access) {
                             setResponseStatus(event, 404);
                             return { error: "Not found" };

package/dist/server/complete-text.js

@@ -1,6 +1,6 @@
 import { getStoredModelForEngine, normalizeModelForEngine, registerBuiltinEngines, resolveEngine, } from "../agent/engine/index.js";
 import { EngineError } from "../agent/engine/types.js";
-import { getOwnerActiveApiKey } from "../agent/production-agent.js";
+import { resolveOwnerEngineApiKey, } from "../agent/production-agent.js";
 import { getRequestUserEmail } from "./request-context.js";
 function normalizeCompleteTextMessages(messages, input) {
     const normalized = [];
@@ -56,14 +56,20 @@ function createCompletionAbortSignal(signal, timeoutMs) {
         },
     };
 }
-async function resolveCompletionApiKey(explicitApiKey) {
-    if (explicitApiKey)
-        return explicitApiKey;
+async function resolveCompletionApiKey(options) {
+    // A caller-supplied key is opaque: `CompleteTextOptions.apiKey` names no
+    // provider, so it keeps the caller's contract and is passed through untagged.
+    if (options.apiKey) {
+        return { apiKey: options.apiKey, apiKeyEnvVar: undefined };
+    }
     try {
-        return await getOwnerActiveApiKey(getRequestUserEmail());
+        return await resolveOwnerEngineApiKey({
+            engineOption: options.engine,
+            ownerEmail: getRequestUserEmail(),
+        });
     }
     catch {
-        return undefined;
+        return { apiKey: undefined, apiKeyEnvVar: undefined };
     }
 }
 /**
@@ -75,10 +81,11 @@ async function resolveCompletionApiKey(explicitApiKey) {
  */
 export async function completeText(options) {
     registerBuiltinEngines();
-    const apiKey = await resolveCompletionApiKey(options.apiKey);
+    const { apiKey, apiKeyEnvVar } = await resolveCompletionApiKey(options);
     const engine = await resolveEngine({
         engineOption: options.engine,
         apiKey,
+        apiKeyEnvVar,
         model: options.model,
         appId: options.appId,
     });