@agent-native/core 0.147.0 → 0.148.1

package/dist/coding-tools/run-code.js

@@ -37,6 +37,9 @@ const DEFAULT_TIMEOUT_MS = 120_000;
 const MAX_TIMEOUT_MS = 600_000;
 const DEFAULT_MAX_OUTPUT_CHARS = 50_000;
 const MAX_OUTPUT_CHARS = 200_000;
+const TOOL_ORCHESTRATION_DEFAULT_MAX_CALLS = 32;
+const TOOL_ORCHESTRATION_MAX_CALLS = 128;
+const TOOL_ORCHESTRATION_MAX_PROVIDER_PAGES = 20;
 /** Hard cap on bridge request bodies so sandboxed code can't exhaust parent memory. */
 const BRIDGE_MAX_BODY_BYTES = 10 * 1024 * 1024;
 /** Tools callable via the sandbox bridge by default. */
@@ -203,8 +206,9 @@ export function createRunCodeEntry(getActions, opts = {}) {
 export async function executeSandboxCode(options) {
     const actions = options.getActions();
     const bridgeToken = crypto.randomBytes(32).toString("hex");
+    const mode = options.mode ?? "run-code";
     // Start bridge server — resolves once the server is listening.
-    const { bridgePort, getUsedTools, cleanup: cleanupBridge, } = await startBridgeServer(bridgeToken, actions, options.context, DEFAULT_BRIDGE_TOOLS, options.extraBridgeTools ?? new Set());
+    const { bridgePort, getUsedTools, cleanup: cleanupBridge, } = await startBridgeServer(bridgeToken, actions, options.context, DEFAULT_BRIDGE_TOOLS, options.extraBridgeTools ?? new Set(), mode, options.maxToolCalls);
     try {
         // Build scrubbed env — only safe POSIX vars, no secrets. The adapter
         // points TMPDIR/TEMP/TMP at the sandbox's own temp dir.
@@ -228,7 +232,7 @@ export async function executeSandboxCode(options) {
         // bridge, env scrub, module, and output formatting stay in the parent
         // regardless of adapter.
         const { stdout, stderr, exitCode, timedOut } = await resolveExecutionSandboxAdapter().run({
-            moduleSource: buildSandboxModule(options.code, bridgePort, bridgeToken),
+            moduleSource: buildSandboxModule(options.code, bridgePort, bridgeToken, mode),
             env: safeEnv,
             timeoutMs: options.timeoutMs,
             bridgePort,
@@ -457,8 +461,14 @@ export function createGetCodeExecutionEntry() {
         },
     };
 }
-async function startBridgeServer(token, actions, context, defaultTools, extraTools) {
+async function startBridgeServer(token, actions, context, defaultTools, extraTools, mode, maxToolCalls) {
     const usedTools = new Set();
+    const callBudget = mode === "tool-orchestration"
+        ? {
+            count: 0,
+            max: normalizeToolCallBudget(maxToolCalls),
+        }
+        : undefined;
     const server = http.createServer((req, res) => {
         if (req.method !== "POST" || req.url !== "/tool") {
             res.writeHead(404);
@@ -489,7 +499,7 @@ async function startBridgeServer(token, actions, context, defaultTools, extraToo
         req.on("end", () => {
             if (rejected)
                 return;
-            handleBridgeRequest(body, actions, context, defaultTools, extraTools, usedTools, res);
+            handleBridgeRequest(body, actions, context, defaultTools, extraTools, usedTools, mode, callBudget, res);
         });
         req.on("error", () => {
             res.writeHead(500);
@@ -515,7 +525,7 @@ async function startBridgeServer(token, actions, context, defaultTools, extraToo
         cleanup,
     };
 }
-function handleBridgeRequest(rawBody, actions, context, defaultTools, extraTools, usedTools, res) {
+function handleBridgeRequest(rawBody, actions, context, defaultTools, extraTools, usedTools, mode, callBudget, res) {
     let parsed;
     try {
         parsed = JSON.parse(rawBody);
@@ -546,7 +556,27 @@ function handleBridgeRequest(rawBody, actions, context, defaultTools, extraTools
     const isReadOnlyAction = entry.readOnly === true &&
         entry.agentTool !== false &&
         entry.toolCallable !== false;
-    if (!defaultTools.has(toolName) &&
+    const toolArgs = parsed.args ?? {};
+    const childArgs = mode === "tool-orchestration"
+        ? boundToolOrchestrationArgs(toolName, toolArgs)
+        : toolArgs;
+    if (mode === "tool-orchestration") {
+        if (callBudget && callBudget.count >= callBudget.max) {
+            res.writeHead(429, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                error: `Tool-orchestration child-call budget exceeded (${callBudget.max}). Aggregate the current results or increase maxToolCalls within its limit.`,
+            }));
+            return;
+        }
+        if (!isAllowedToolOrchestrationCall(toolName, childArgs, entry)) {
+            res.writeHead(403, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                error: `Tool "${toolName}" is not permitted by tool-orchestration. Only read-only tools and GET/HEAD provider or web reads without staging or saving files are allowed; call mutating tools directly.`,
+            }));
+            return;
+        }
+    }
+    else if (!defaultTools.has(toolName) &&
         !extraTools.has(toolName) &&
         !isReadOnlyAction) {
         // A registered, agent-exposed action that isn't read-only is a mutation.
@@ -563,12 +593,13 @@ function handleBridgeRequest(rawBody, actions, context, defaultTools, extraTools
         }));
         return;
     }
-    const toolArgs = parsed.args ?? {};
+    if (callBudget)
+        callBudget.count += 1;
     usedTools.add(toolName);
     // Run the tool with the parent request context so auth/org/owner resolution
     // works exactly as it does in the normal agent loop.
     entry
-        .run(toolArgs, context)
+        .run(childArgs, context)
         .then((result) => {
         const body = typeof result === "string" ? result : JSON.stringify(result, null, 2);
         res.writeHead(200, { "Content-Type": "application/json" });
@@ -580,6 +611,105 @@ function handleBridgeRequest(rawBody, actions, context, defaultTools, extraTools
         res.end(JSON.stringify({ error: message }));
     });
 }
+function normalizeToolCallBudget(value) {
+    if (!Number.isFinite(value) || !value || value <= 0) {
+        return TOOL_ORCHESTRATION_DEFAULT_MAX_CALLS;
+    }
+    return Math.min(Math.floor(value), TOOL_ORCHESTRATION_MAX_CALLS);
+}
+function isAllowedToolOrchestrationCall(toolName, args, entry) {
+    if (toolName === "workspace-files") {
+        // This is an internal bridge action by design, so agentTool/toolCallable
+        // are intentionally not required here. Its operation enum is the policy
+        // boundary for the read-only workspace surface.
+        return isCallableWithoutApproval(entry) && isReadOnlyWorkspaceRequest(args);
+    }
+    if (toolName === "provider-api-request") {
+        return isReadOnlyProviderApiRequest(args, entry);
+    }
+    return isReadOnlyOrchestrationAction(args, entry);
+}
+function isCallableWithoutApproval(entry) {
+    // The bridge calls ActionEntry.run directly for child reads. A predicate
+    // approval gate must therefore fail closed rather than being silently
+    // bypassed by this bounded path.
+    return entry.needsApproval === undefined || entry.needsApproval === false;
+}
+function isReadOnlyWorkspaceRequest(args) {
+    const action = typeof args.action === "string" ? args.action : "";
+    return action === "read" || action === "list" || action === "grep";
+}
+function isReadOnlyProviderApiRequest(args, entry) {
+    if (!entry.tool ||
+        !isCallableWithoutApproval(entry) ||
+        entry.agentTool === false ||
+        entry.allowInPlanMode === false) {
+        return false;
+    }
+    const method = String(args.method ?? "GET").toUpperCase();
+    return ((method === "GET" || method === "HEAD") &&
+        args.stageAs == null &&
+        args.saveToFile == null);
+}
+function isReadOnlyOrchestrationAction(args, entry) {
+    if (!entry.tool ||
+        !isCallableWithoutApproval(entry) ||
+        entry.agentTool === false ||
+        entry.toolCallable === false ||
+        entry.allowInPlanMode === false) {
+        return false;
+    }
+    const planMode = entry.planMode;
+    if (!planMode)
+        return entry.readOnly === true;
+    const input = args;
+    if (planMode.allowedProperties &&
+        Object.keys(args).some((key) => !planMode.allowedProperties.includes(key))) {
+        return false;
+    }
+    if (planMode.omittedProperties?.some((key) => Object.prototype.hasOwnProperty.call(args, key))) {
+        return false;
+    }
+    if (Object.entries(planMode.allowedValues ?? {}).some(([key, allowed]) => {
+        const value = args[key];
+        return (value !== null &&
+            value !== undefined &&
+            (typeof value !== "string" || !allowed.includes(value)));
+    })) {
+        return false;
+    }
+    try {
+        const effect = typeof planMode.effect === "function"
+            ? planMode.effect(input)
+            : planMode.effect;
+        return effect === "read";
+    }
+    catch (error) {
+        console.warn("[run-code] tool-orchestration read-only policy classifier failed closed:", error instanceof Error ? error.message : String(error));
+        return false;
+    }
+}
+function boundToolOrchestrationArgs(toolName, args) {
+    if (toolName !== "provider-api-request")
+        return args;
+    const fetchAllPages = args.fetchAllPages;
+    if (!fetchAllPages ||
+        typeof fetchAllPages !== "object" ||
+        Array.isArray(fetchAllPages)) {
+        return args;
+    }
+    const requestedMaxPages = Number(fetchAllPages.maxPages);
+    const maxPages = Number.isInteger(requestedMaxPages) && requestedMaxPages > 0
+        ? Math.min(Math.floor(requestedMaxPages), TOOL_ORCHESTRATION_MAX_PROVIDER_PAGES)
+        : TOOL_ORCHESTRATION_MAX_PROVIDER_PAGES;
+    return {
+        ...args,
+        fetchAllPages: {
+            ...fetchAllPages,
+            maxPages,
+        },
+    };
+}
 // ---------------------------------------------------------------------------
 // Sandbox module template
 // ---------------------------------------------------------------------------
@@ -589,7 +719,61 @@ function handleBridgeRequest(rawBody, actions, context, defaultTools, extraTools
  *     `providerSearchAll`, and `webFetch` helpers via the bridge.
  *  2. Runs the user's code as top-level await in an async IIFE.
  */
-function buildSandboxModule(userCode, bridgePort, bridgeToken) {
+function buildSandboxModule(userCode, bridgePort, bridgeToken, mode = "run-code") {
+    const orchestrationHelpers = mode === "tool-orchestration"
+        ? `
+/**
+ * Search the live registry for read-only or conditionally read-only tools, then call one
+ * of the returned names with toolCall(). The parent host enforces the same
+ * policy again, so this is discovery guidance rather than an authorization
+ * boundary.
+ */
+async function toolSearch(query = "", options = {}) {
+  const rawResult = await _bridgeCall("tool-search", {
+    ...(query ? { query } : {}),
+    ...(options.limit !== undefined ? { limit: options.limit } : {}),
+    includeSchemas: true,
+    readOnlyOnly: true,
+  });
+  return _parseBridgeResult(rawResult);
+}
+
+async function toolCall(name, args = {}) {
+  return _parseBridgeResult(await _bridgeCall(name, args));
+}
+`
+        : "";
+    const workspaceMutationHelpers = mode === "run-code"
+        ? `
+/**
+ * Write (create or overwrite) a workspace file. Use \`scratch/...\` for
+ * temporary staging files.
+ * \`content\` must be a string. Returns metadata
+ * { resourceId, path, contentType, sizeBytes, updatedAt }.
+ */
+async function workspaceWrite(path, content, contentType = "text/plain") {
+  const rawResult = await _bridgeCall("workspace-files", {
+    action: "write",
+    path,
+    content: typeof content === "string" ? content : JSON.stringify(content),
+    contentType,
+  });
+  try { return typeof rawResult === "string" ? JSON.parse(rawResult) : rawResult; } catch { return rawResult; }
+}
+
+/**
+ * Append text to a workspace file (creates if absent).
+ */
+async function workspaceAppend(path, content) {
+  const rawResult = await _bridgeCall("workspace-files", {
+    action: "append",
+    path,
+    content: typeof content === "string" ? content : JSON.stringify(content),
+  });
+  try { return typeof rawResult === "string" ? JSON.parse(rawResult) : rawResult; } catch { return rawResult; }
+}
+`
+        : "";
     return `
 import { createRequire } from "node:module";
 const require = createRequire(import.meta.url);
@@ -646,6 +830,8 @@ async function appAction(name, args = {}) {
   return _parseBridgeResult(await _bridgeCall(name, args));
 }
 
+${orchestrationHelpers}
+
 async function providerRequest(provider, apiPath, init = {}) {
   const method = (init.method || "GET").toUpperCase();
   const rawResult = await _bridgeCall("provider-api-request", {
@@ -1388,33 +1574,7 @@ async function workspaceReadMeta(path, opts = {}) {
   return _parseBridgeResult(rawResult);
 }
 
-/**
- * Write (create or overwrite) a workspace file. Use \`scratch/...\` for
- * temporary staging files.
- * \`content\` must be a string. Returns metadata
- * { resourceId, path, contentType, sizeBytes, updatedAt }.
- */
-async function workspaceWrite(path, content, contentType = "text/plain") {
-  const rawResult = await _bridgeCall("workspace-files", {
-    action: "write",
-    path,
-    content: typeof content === "string" ? content : JSON.stringify(content),
-    contentType,
-  });
-  try { return typeof rawResult === "string" ? JSON.parse(rawResult) : rawResult; } catch { return rawResult; }
-}
-
-/**
- * Append text to a workspace file (creates if absent).
- */
-async function workspaceAppend(path, content) {
-  const rawResult = await _bridgeCall("workspace-files", {
-    action: "append",
-    path,
-    content: typeof content === "string" ? content : JSON.stringify(content),
-  });
-  try { return typeof rawResult === "string" ? JSON.parse(rawResult) : rawResult; } catch { return rawResult; }
-}
+${workspaceMutationHelpers}
 
 /**
  * List workspace files, optionally filtered by path prefix.

package/dist/coding-tools/tool-orchestration.d.ts

@@ -0,0 +1,10 @@
+import type { ActionEntry } from "../agent/production-agent.js";
+/**
+ * Create the bounded read-only orchestration tool.
+ *
+ * This deliberately has a separate registry entry from run-code. The latter
+ * retains its existing workspace staging and background-execution contract;
+ * this entry is for short fan-out, reduction, and aggregation over tools that
+ * the host can prove are read-only for the supplied arguments.
+ */
+export declare function createToolOrchestrationEntry(getActions: () => Record<string, ActionEntry>): ActionEntry;

package/dist/coding-tools/tool-orchestration.js

@@ -0,0 +1,107 @@
+import { executeSandboxCode, } from "./run-code.js";
+const DEFAULT_TIMEOUT_MS = 60_000;
+const MAX_TIMEOUT_MS = 120_000;
+const DEFAULT_MAX_OUTPUT_CHARS = 50_000;
+const MAX_OUTPUT_CHARS = 100_000;
+const DEFAULT_MAX_TOOL_CALLS = 32;
+const MAX_TOOL_CALLS = 128;
+/**
+ * Create the bounded read-only orchestration tool.
+ *
+ * This deliberately has a separate registry entry from run-code. The latter
+ * retains its existing workspace staging and background-execution contract;
+ * this entry is for short fan-out, reduction, and aggregation over tools that
+ * the host can prove are read-only for the supplied arguments.
+ */
+export function createToolOrchestrationEntry(getActions) {
+    return {
+        readOnly: true,
+        allowInPlanMode: false,
+        timeoutMs: MAX_TIMEOUT_MS,
+        maxResultChars: MAX_OUTPUT_CHARS,
+        tool: {
+            description: [
+                "Run a bounded JavaScript orchestration script in the existing sandbox.",
+                "Use toolSearch(query) to discover read-only or conditionally read-only tools, then toolCall(name, args) to fan out, join, filter, and aggregate their results without putting every intermediate payload into chat. The host rechecks conditional policies against each argument object.",
+                "The host rechecks every child call: mutating actions, hidden actions, provider writes, non-GET/HEAD web requests, staging, file saves, and workspace writes are rejected. Call mutations directly as native tools.",
+                "The orchestration sandbox has no background mode, a strict child-tool-call budget, and a 20-page cap on each provider fetchAllPages call. It is a bounded orchestration path, not a general-purpose replacement for run-code.",
+                "Available globals: toolSearch(query?, options?), toolCall(name, args?), providerFetch(provider, path, init?), providerFetchAll(...), providerSearchAll(...), webFetch(url, init?), webRead(url, init?), workspaceRead(path, opts?), workspaceReadMeta(path, opts?), workspaceList(prefix?), and appAction(name, args?) for eligible read-only actions.",
+                "Print only the compact result needed by the conversation with console.log().",
+            ].join(" "),
+            parameters: {
+                type: "object",
+                properties: {
+                    code: {
+                        type: "string",
+                        description: "JavaScript source to execute. ESM syntax and top-level await are supported.",
+                    },
+                    timeoutMs: {
+                        type: "number",
+                        description: `Execution timeout in milliseconds. Default: ${DEFAULT_TIMEOUT_MS}; max: ${MAX_TIMEOUT_MS}.`,
+                    },
+                    maxOutputChars: {
+                        type: "number",
+                        description: `Maximum combined stdout+stderr characters. Default: ${DEFAULT_MAX_OUTPUT_CHARS}; max: ${MAX_OUTPUT_CHARS}.`,
+                    },
+                    maxToolCalls: {
+                        type: "number",
+                        description: `Maximum bridged child-tool calls. Default: ${DEFAULT_MAX_TOOL_CALLS}; max: ${MAX_TOOL_CALLS}.`,
+                    },
+                },
+                required: ["code"],
+            },
+        },
+        run: async (args, context) => {
+            if (args.background || args.executionId) {
+                return "Error: tool-orchestration is foreground-only and does not support background or polling arguments. Use run-code for durable long-running execution.";
+            }
+            const code = typeof args.code === "string" ? args.code : "";
+            if (!code.trim())
+                return "Error: code is required.";
+            const requestedTimeout = Number(args.timeoutMs);
+            const timeoutMs = Number.isFinite(requestedTimeout) && requestedTimeout > 0
+                ? Math.min(requestedTimeout, MAX_TIMEOUT_MS)
+                : DEFAULT_TIMEOUT_MS;
+            const requestedOutput = Number(args.maxOutputChars);
+            const maxOutputChars = Number.isFinite(requestedOutput) && requestedOutput > 0
+                ? Math.min(requestedOutput, MAX_OUTPUT_CHARS)
+                : DEFAULT_MAX_OUTPUT_CHARS;
+            const requestedCalls = Number(args.maxToolCalls);
+            const maxToolCalls = Number.isFinite(requestedCalls) && requestedCalls > 0
+                ? Math.min(Math.floor(requestedCalls), MAX_TOOL_CALLS)
+                : DEFAULT_MAX_TOOL_CALLS;
+            const result = await executeSandboxCode({
+                code,
+                timeoutMs,
+                getActions,
+                mode: "tool-orchestration",
+                maxToolCalls,
+                context,
+            });
+            return formatResult(result, timeoutMs, maxOutputChars);
+        },
+    };
+}
+function formatResult(result, timeoutMs, maxOutputChars) {
+    const combined = [
+        result.stdout ? `stdout:\n${result.stdout}` : "",
+        result.stderr ? `stderr:\n${result.stderr}` : "",
+    ]
+        .filter(Boolean)
+        .join("\n\n") || "(no output)";
+    const lines = [];
+    if (result.timedOut)
+        lines.push(`timedOut: true (${timeoutMs}ms)`);
+    if (result.exitCode !== 0 && result.exitCode !== null) {
+        lines.push(`exitCode: ${result.exitCode}`);
+    }
+    if (result.bridgeToolsUsed.length) {
+        lines.push(`bridgeToolsUsed: ${result.bridgeToolsUsed.join(", ")}`);
+    }
+    lines.push(combined);
+    const full = lines.join("\n\n");
+    if (full.length <= maxOutputChars)
+        return full;
+    const truncated = full.slice(0, maxOutputChars);
+    return `${truncated}\n\n...[truncated ${(full.length - maxOutputChars).toLocaleString()} chars]`;
+}

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/jobs/frontmatter.d.ts

@@ -54,6 +54,15 @@ export interface JobFrontmatter {
      */
     delegatedPolicyId?: string;
 }
+/**
+ * Return whether a scheduler or trigger dispatcher may claim this resource.
+ *
+ * Personal legacy jobs have no app owner and remain compatible with the
+ * shared scheduler. An organization-owned resource without an explicit app
+ * owner is ambiguous, though: letting every installed app claim it can run
+ * the same job multiple times and with the wrong deployment credentials.
+ */
+export declare function jobBelongsToApp(meta: Pick<JobFrontmatter, "appId" | "orgId">, appId: string | null | undefined): boolean;
 export interface JobResourceClassification {
     kind: "job" | "automation";
     hasExplicitTriggerType: boolean;

package/dist/jobs/frontmatter.js

@@ -1,3 +1,19 @@
+/**
+ * Return whether a scheduler or trigger dispatcher may claim this resource.
+ *
+ * Personal legacy jobs have no app owner and remain compatible with the
+ * shared scheduler. An organization-owned resource without an explicit app
+ * owner is ambiguous, though: letting every installed app claim it can run
+ * the same job multiple times and with the wrong deployment credentials.
+ */
+export function jobBelongsToApp(meta, appId) {
+    const ownerAppId = meta.appId?.trim();
+    if (ownerAppId) {
+        const schedulerAppId = appId?.trim();
+        return Boolean(schedulerAppId && ownerAppId === schedulerAppId);
+    }
+    return !meta.orgId?.trim();
+}
 const MAX_JOB_MCP_TOOLS = 64;
 const JOB_MCP_TOOL_NAME_RE = /^mcp__[^\s]+__[^\s]+$/;
 const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n)?([\s\S]*)$/;

package/dist/jobs/scheduler.js

@@ -1,7 +1,7 @@
 import { resourceGetByPath, resourceListAllOwners, resourcePutIfCurrent, } from "../resources/store.js";
 import { backgroundRunCutOffReason, isBackgroundAutomationRunActive, resolveBackgroundAutomationIdentity, runBackgroundAutomation, } from "./background-automation-runner.js";
 import { nextOccurrence, isValidCron, describeCron, effectiveTimezone, } from "./cron.js";
-import { buildJobResourceContent, parseJobResource, } from "./frontmatter.js";
+import { buildJobResourceContent, jobBelongsToApp, parseJobResource, } from "./frontmatter.js";
 import { claimAutomationRun, finishAutomationRun, getAutomationRun, listAutomationRuns, } from "./run-history.js";
 import { acquireAutomationSchedulerLease, recordAutomationSchedulerHealth, releaseAutomationSchedulerLease, renewAutomationSchedulerLease, AUTOMATION_SCHEDULER_LEASE_RENEWAL_MS, } from "./scheduler-health.js";
 // ─── Frontmatter parsing ────────────────────────────────────────────────────
@@ -18,13 +18,6 @@ const MAX_IDENTITY_PREFLIGHTS_PER_TICK = MAX_CONCURRENT_SCHEDULED_JOBS * 4;
 const IDENTITY_FAILURE_RETRY_MS = 5 * 60_000;
 const _activeScheduledJobs = new Set();
 const _preflightingScheduledJobs = new Set();
-function jobBelongsToApp(meta, appId) {
-    const ownerAppId = meta.appId?.trim();
-    if (!ownerAppId)
-        return true;
-    const schedulerAppId = appId?.trim();
-    return Boolean(schedulerAppId && ownerAppId === schedulerAppId);
-}
 // Skip the DB query on every tick if we recently confirmed no jobs exist.
 // `_hasJobsCache` is invalidated whenever a `jobs/*` resource is written or
 // deleted (subscribed below), and refreshed at most every 5 minutes.
@@ -429,6 +422,13 @@ async function executeJob(resource, meta, body, deps, now, options = {}) {
             requestContext,
             ...(options.historyId ? { historyId: options.historyId } : {}),
             actionCaller: "automation",
+            actionAutomation: {
+                triggerId: resource.id,
+                triggerName: jobName,
+                ...(meta.delegatedPolicyId
+                    ? { policyId: meta.delegatedPolicyId }
+                    : {}),
+            },
         }, deps);
         await recordExecutionOutcome(resource, {
             lastRun: meta.lastRun,

package/dist/jobs/tools.d.ts

@@ -1,6 +1,6 @@
 import type { ActionEntry } from "../agent/production-agent.js";
 import { type JobFrontmatter } from "./scheduler.js";
-export declare function jobBelongsToApp(meta: JobFrontmatter, appId?: string): boolean;
+export { jobBelongsToApp } from "./frontmatter.js";
 /**
  * Authorise a mutation (update / delete) against a job resource. When the
  * job is in the SHARED scope the caller must either be the original

package/dist/jobs/tools.js

@@ -3,8 +3,9 @@ import { resolveUserSchedulingTimezone } from "../localization/user-timezone.js"
 import { resourcePut, resourceGetByPath, resourceList, resourceDelete, organizationIdFromResourceOwner, sharedResourceOwner, SHARED_OWNER, } from "../resources/store.js";
 import { getRequestUserEmail, getRequestOrgId, getIntegrationRequestContext, } from "../server/request-context.js";
 import { isValidCron, nextOccurrence, describeCron, effectiveTimezone, isValidTimezone, } from "./cron.js";
-import { classifyJobResource } from "./frontmatter.js";
+import { classifyJobResource, jobBelongsToApp } from "./frontmatter.js";
 import { parseJobFrontmatter, buildJobContent, normalizeJobMcpTools, } from "./scheduler.js";
+export { jobBelongsToApp } from "./frontmatter.js";
 function getOwner() {
     const email = getRequestUserEmail();
     if (!email)
@@ -14,12 +15,6 @@ function getOwner() {
 function getSharedOwner() {
     return sharedResourceOwner(getRequestOrgId());
 }
-export function jobBelongsToApp(meta, appId) {
-    const ownerAppId = meta.appId?.trim();
-    if (!ownerAppId)
-        return true;
-    return ownerAppId === appId?.trim();
-}
 /**
  * Determine if the current request's user is an org owner/admin in the
  * given org. Used to allow privileged users to update or delete shared

package/dist/localization/default-messages.d.ts

@@ -455,6 +455,26 @@ declare const messages: {
         builderModelCredits: string;
         addOwnKeys: string;
         configureProviderKeys: string;
+        chooseProvider: string;
+        searchProviders: string;
+        noProvidersFound: string;
+        availableProviders: string;
+        configured: string;
+        apiKey: string;
+        localRuntime: string;
+        enterApiKey: string;
+        providerSetupFailed: string;
+        noApiKeyNeeded: string;
+        modelId: string;
+        endpointUrl: string;
+        optional: string;
+        ollamaEndpointHint: string;
+        compatibleEndpointHint: string;
+        savingProvider: string;
+        providerSaved: string;
+        useProvider: string;
+        saveAndUseProvider: string;
+        getApiKey: string;
         checkingAiConnection: string;
         delegatedAgent: {
             asking: string;

package/dist/localization/default-messages.js

@@ -389,7 +389,7 @@ const messages = {
             threadDebugRefreshFailures: "Refresh failed runs",
             threadDebugNoFailures: "No failed runs found.",
             threadDebugCurrentDatabase: "Current Dispatch DB",
-            threadDebugSearchPlaceholder: "Search title, preview, messages, tools",
+            threadDebugSearchPlaceholder: "Search threads or email",
             threadDebugSearch: "Search",
             threadDebugLookupPlaceholder: "Paste thread or request/run ID",
             threadDebugInspect: "Inspect",
@@ -455,12 +455,32 @@ const messages = {
         askAgentTitle: "Ask the agent",
         askAgentPlaceholder: "Tell the agent what you want to do…",
         connectAi: "Connect AI",
-        builderOrOwnKeys: "Use Builder.io free credits, or add your own provider keys.",
+        builderOrOwnKeys: "Choose Builder.io or custom keys.",
         connectBuilderIo: "Connect Builder.io",
         connectingBuilder: "Connecting Builder.io…",
         builderModelCredits: "Free credits for Claude, OpenAI & Gemini",
-        addOwnKeys: "Add your own keys",
-        configureProviderKeys: "Configure Anthropic, OpenAI, or another provider",
+        addOwnKeys: "Custom keys",
+        configureProviderKeys: "Choose a provider.",
+        chooseProvider: "Choose a provider",
+        searchProviders: "Search providers...",
+        noProvidersFound: "No providers found.",
+        availableProviders: "Available providers",
+        configured: "Configured",
+        apiKey: "API key",
+        localRuntime: "Local",
+        enterApiKey: "Enter your {{provider}} API key.",
+        providerSetupFailed: "Could not configure this provider.",
+        noApiKeyNeeded: "No API key required.",
+        modelId: "Model ID",
+        endpointUrl: "Endpoint URL",
+        optional: "Optional",
+        ollamaEndpointHint: "Defaults to Ollama at http://localhost:11434.",
+        compatibleEndpointHint: "Use this for LiteLLM or another OpenAI-compatible gateway.",
+        savingProvider: "Saving...",
+        providerSaved: "Connected",
+        useProvider: "Use {{provider}}",
+        saveAndUseProvider: "Save and use {{provider}}",
+        getApiKey: "Get an API key",
         checkingAiConnection: "Checking AI connection...",
         delegatedAgent: {
             asking: "Asking {{name}}...",
@@ -475,7 +495,7 @@ const messages = {
             setupTitle: "Set up voice mode",
             setupDescription: "Connect Builder.io to use managed voice with free credits, or add your own keys.",
             connectBuilder: "Connect Builder.io",
-            useOpenAiKey: "Add your own keys",
+            useOpenAiKey: "Custom keys",
             startWithOpenAiKey: "Start with OpenAI key",
             start: "Real-time voice",
             keepDictating: "Dictate",

package/dist/notifications/routes.d.ts

@@ -11,14 +11,14 @@
  *   DELETE /_agent-native/notifications/:id         — delete
  */
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
+    error?: undefined;
     count: number;
     updated?: undefined;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     count?: undefined;
     updated: number;
-    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -26,8 +26,8 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
+    error?: undefined;
     count?: undefined;
     updated?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;