@agent-native/core 0.148.1 → 0.149.1

package/corpus/templates/slides/server/lib/image-proxy-url.ts

@@ -0,0 +1,192 @@
+import net from "node:net";
+
+/**
+ * Hostnames that never belong to a legitimate slide image but are classic
+ * SSRF targets. Cloud metadata endpoints resolve to a link-local address
+ * that `isPrivateAddress` already rejects; they are listed here so the
+ * request is refused before a DNS query is issued.
+ */
+const BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "metadata.google.internal",
+  "metadata",
+]);
+
+const BLOCKED_SUFFIXES = [".localhost", ".local", ".internal", ".home.arpa"];
+
+/** Largest image we are willing to buffer and hand back to the browser. */
+export const MAX_PROXIED_IMAGE_BYTES = 15 * 1024 * 1024;
+
+/** Redirect hops to follow. Each hop is re-validated before it is fetched. */
+export const MAX_PROXY_REDIRECTS = 3;
+
+/**
+ * Whether an IP literal points somewhere inside our own infrastructure.
+ * Anything unroutable, loopback, link-local, or RFC1918 is refused, as is
+ * any address we cannot parse — unknown means unsafe here.
+ */
+export function isPrivateAddress(address: string): boolean {
+  const version = net.isIP(address);
+
+  if (version === 4) {
+    const parts = address.split(".").map((part) => Number(part));
+    if (parts.length !== 4 || parts.some((part) => Number.isNaN(part))) {
+      return true;
+    }
+    const [a, b] = parts;
+    if (a === 0 || a === 10 || a === 127) return true;
+    if (a === 169 && b === 254) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 100 && b >= 64 && b <= 127) return true;
+    if (a >= 224) return true;
+    return false;
+  }
+
+  if (version === 6) {
+    // Classify on the expanded hextets, never on the text. `::ffff:127.0.0.1`
+    // and `::ffff:7f00:1` are the same address, and a prefix-matching check
+    // sees only the first.
+    const hextets = expandIpv6(address);
+    if (!hextets) return true;
+
+    const embedsIpv4 =
+      hextets.slice(0, 5).every((part) => part === 0) &&
+      (hextets[5] === 0xffff || hextets[5] === 0);
+    if (embedsIpv4 && (hextets[6] !== 0 || hextets[7] !== 0)) {
+      const ipv4 = [
+        hextets[6] >> 8,
+        hextets[6] & 0xff,
+        hextets[7] >> 8,
+        hextets[7] & 0xff,
+      ].join(".");
+      return isPrivateAddress(ipv4);
+    }
+
+    // Unspecified (::) and loopback (::1).
+    if (hextets.every((part) => part === 0)) return true;
+    if (hextets.slice(0, 7).every((part) => part === 0) && hextets[7] === 1) {
+      return true;
+    }
+    // Unique-local fc00::/7, link-local fe80::/10, multicast ff00::/8.
+    if ((hextets[0] & 0xfe00) === 0xfc00) return true;
+    if ((hextets[0] & 0xffc0) === 0xfe80) return true;
+    if ((hextets[0] & 0xff00) === 0xff00) return true;
+    // NAT64 well-known prefix 64:ff9b::/96 tunnels an IPv4 destination.
+    if (hextets[0] === 0x0064 && hextets[1] === 0xff9b) {
+      const ipv4 = [
+        hextets[6] >> 8,
+        hextets[6] & 0xff,
+        hextets[7] >> 8,
+        hextets[7] & 0xff,
+      ].join(".");
+      return isPrivateAddress(ipv4);
+    }
+    return false;
+  }
+
+  return true;
+}
+
+/**
+ * Expand any textual IPv6 form into its 8 hextets, including `::` elision and
+ * a dotted IPv4 tail. Returns null when the input is not parseable.
+ */
+export function expandIpv6(address: string): number[] | null {
+  // Zone indices ("fe80::1%eth0") are routing hints, not part of the address.
+  const bare = address.toLowerCase().split("%")[0];
+  if (!bare) return null;
+
+  let head = bare;
+  let tail = "";
+  const elision = bare.indexOf("::");
+  if (elision !== -1) {
+    head = bare.slice(0, elision);
+    tail = bare.slice(elision + 2);
+  }
+
+  const parseGroups = (segment: string): string[] =>
+    segment.length === 0 ? [] : segment.split(":");
+
+  const headGroups = parseGroups(head);
+  const tailGroups = parseGroups(tail);
+  const all = [...headGroups, ...tailGroups];
+
+  // A dotted IPv4 tail occupies the final two hextets.
+  const last = all[all.length - 1];
+  let ipv4Tail: number[] | null = null;
+  if (last?.includes(".")) {
+    if (net.isIP(last) !== 4) return null;
+    const octets = last.split(".").map((part) => Number(part));
+    if (
+      octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)
+    )
+      return null;
+    ipv4Tail = [(octets[0] << 8) | octets[1], (octets[2] << 8) | octets[3]];
+    if (tailGroups.length > 0) tailGroups.pop();
+    else headGroups.pop();
+  }
+
+  const toHextets = (groups: string[]): number[] | null => {
+    const out: number[] = [];
+    for (const group of groups) {
+      if (!/^[0-9a-f]{1,4}$/.test(group)) return null;
+      out.push(parseInt(group, 16));
+    }
+    return out;
+  };
+
+  const headParts = toHextets(headGroups);
+  const tailParts = toHextets(tailGroups);
+  if (!headParts || !tailParts) return null;
+
+  const explicit = [...headParts, ...tailParts, ...(ipv4Tail ? ipv4Tail : [])]
+    .length;
+  if (explicit > 8) return null;
+
+  if (elision === -1) {
+    if (explicit !== 8) return null;
+    return [...headParts, ...(ipv4Tail ?? [])];
+  }
+
+  const fill = new Array(8 - explicit).fill(0) as number[];
+  return [...headParts, ...fill, ...tailParts, ...(ipv4Tail ?? [])];
+}
+
+/**
+ * Parse a caller-supplied image URL, refusing anything that is not a plain
+ * public http(s) resource. Returns null rather than throwing so callers can
+ * answer with a single 400.
+ */
+export function parseProxyableImageUrl(raw: string): URL | null {
+  if (!raw) return null;
+
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    // coercion-ok: null is this function's documented "refused" result and
+    // the caller answers 400; an unparseable URL carries no other detail.
+    return null;
+  }
+
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  // Credentials in the URL would be replayed by the server on the user's
+  // behalf against a host they may not control.
+  if (url.username || url.password) return null;
+
+  const host = url.hostname.toLowerCase().replace(/\.$/, "");
+  if (!host) return null;
+  if (BLOCKED_HOSTNAMES.has(host)) return null;
+  if (BLOCKED_SUFFIXES.some((suffix) => host.endsWith(suffix))) return null;
+
+  const literal = host.startsWith("[") ? host.slice(1, -1) : host;
+  if (net.isIP(literal) && isPrivateAddress(literal)) return null;
+
+  return url;
+}
+
+// A hostname is no longer validated here before fetching. Resolving once for
+// the check and again for the connection let a DNS-rebinding host answer
+// differently each time, so the address check now lives in the socket's
+// `lookup` — see `publicOnlyLookup` in fetch-remote-image.ts.

package/corpus/templates/slides/server/plugins/agent-chat.ts

@@ -66,7 +66,7 @@ Image workflow is strict. For direct insertion, call generate-image-api with ins
 
 Provider-specific Slides actions are shortcuts, not limits. If a first-class action cannot express the exact Google Drive endpoint, file metadata field, export format, query, request body, pagination mode, payload shape, or API version needed, call provider-api-catalog and provider-api-docs as needed, then call provider-api-request against the real provider API. Use the raw provider API escape hatch instead of weakening the answer or claiming Slides cannot do something the underlying Google Drive API can do.
 
-Slides' Google Drive provider API uses the user's connected Google Docs OAuth account. The drive.file scope is intentionally limited to files the user selected or the app created. For large Drive file lists or metadata sweeps, pass stageAs and pagination options to provider-api-request, then use query-staged-dataset to count, filter, group, or project the staged rows.
+Slides' Google Drive provider API uses the user's connected Google Docs OAuth account. Picker imports keep the per-file drive.file path, while pasted Google Slides links use Drive export access and may ask the user to reconnect Google. For large Drive file lists or metadata sweeps, pass stageAs and pagination options to provider-api-request, then use query-staged-dataset to count, filter, group, or project the staged rows.
 
 When a Google Drive or Google Slides request needs authentication, tell the user to use the Connect Google button shown in Slides. Do not expose internal routes, API endpoints, OAuth setup instructions, client IDs, or keys in the response, and do not ask the user to configure an API manually.`,
   mentionProviders: async () => {

package/corpus/templates/slides/server/routes/api/image-proxy.get.ts

@@ -0,0 +1,65 @@
+import { getSession } from "@agent-native/core/server";
+import { defineEventHandler, getQuery, setResponseStatus } from "h3";
+
+import {
+  fetchRemoteImage,
+  type RemoteImageFailure,
+} from "../../lib/fetch-remote-image.js";
+
+/**
+ * Re-serve a remote image from our own origin.
+ *
+ * PDF/PPTX export rasterizes the slide DOM through a canvas, and the browser
+ * blanks out any image whose host does not send `Access-Control-Allow-Origin`.
+ * No client-side flag can override that, so images on hosts without CORS have
+ * to come back through us to be same-origin.
+ *
+ * This is an authenticated, image-only, size-capped fetcher — not a general
+ * proxy. See `fetch-remote-image.ts` for the address pinning that keeps it
+ * from being turned into an SSRF primitive.
+ */
+const FAILURE_STATUS: Record<RemoteImageFailure, number> = {
+  "unsupported-url": 400,
+  "blocked-address": 400,
+  "fetch-failed": 502,
+  "too-many-redirects": 502,
+  "not-an-image": 415,
+  "too-large": 413,
+};
+
+const FAILURE_MESSAGE: Record<RemoteImageFailure, string> = {
+  "unsupported-url": "Unsupported image URL",
+  "blocked-address": "Unsupported image URL",
+  "fetch-failed": "Could not fetch image",
+  "too-many-redirects": "Too many redirects",
+  "not-an-image": "Not an image",
+  "too-large": "Image too large",
+};
+
+export default defineEventHandler(async (event) => {
+  const session = await getSession(event);
+  if (!session?.email) {
+    setResponseStatus(event, 401);
+    return { error: "Unauthorized" };
+  }
+
+  const raw = getQuery(event).url;
+  if (typeof raw !== "string") {
+    setResponseStatus(event, 400);
+    return { error: "Missing url" };
+  }
+
+  const result = await fetchRemoteImage(raw);
+  if (!result.ok) {
+    setResponseStatus(event, FAILURE_STATUS[result.reason]);
+    return { error: FAILURE_MESSAGE[result.reason] };
+  }
+
+  event.node?.res?.setHeader("Content-Type", result.contentType);
+  event.node?.res?.setHeader("Content-Length", String(result.body.byteLength));
+  event.node?.res?.setHeader("Cache-Control", "private, max-age=3600");
+  // The canvas reads these pixels back, so the response must be explicitly
+  // usable cross-origin even though it is served from our own host.
+  event.node?.res?.setHeader("Access-Control-Allow-Origin", "*");
+  return result.body;
+});

package/dist/agent/engine/registry.d.ts

@@ -7,6 +7,7 @@
  *
  * Built-in engines (anthropic, ai-sdk) are auto-registered by builtin.ts.
  */
+import { type BuilderCredentialLookupIdentity } from "../../server/credential-provider.js";
 import type { AgentEngine, EngineCapabilities } from "./types.js";
 export interface AgentEngineEntry {
     /** Unique name, e.g. "anthropic", "ai-sdk:anthropic", "ai-sdk:openai" */
@@ -131,7 +132,7 @@ export declare function detectEngineFromEnvForRequest(): Promise<AgentEngineEntr
  * `/builder/status` resolves them via the same request org context, and the
  * chat engine picker must not disagree with that card.
  */
-export declare function detectEngineFromUserSecrets(): Promise<AgentEngineEntry | null>;
+export declare function detectEngineFromUserSecrets(identity?: BuilderCredentialLookupIdentity): Promise<AgentEngineEntry | null>;
 /**
  * Legacy inline API keys on the global `agent-engine` settings row are
  * intentionally ignored. That row is deployment-wide, so treating
@@ -158,7 +159,9 @@ export declare function isStoredEngineUsable(stored: unknown, entry: AgentEngine
  * deploy env vars; this async helper is what request-time routes should use
  * when deciding whether a stored engine can actually run for the current user.
  */
-export declare function isStoredEngineUsableForRequest(stored: unknown, entry: AgentEngineEntry): Promise<boolean>;
+export declare function isStoredEngineUsableForRequest(stored: unknown, entry: AgentEngineEntry, options?: {
+    credentialIdentity?: BuilderCredentialLookupIdentity;
+}): Promise<boolean>;
 /**
  * Request-aware credential preflight for an already-resolved engine instance.
  * `resolveEngine()` may still return a default or explicitly requested engine
@@ -167,6 +170,7 @@ export declare function isStoredEngineUsableForRequest(stored: unknown, entry: A
  */
 export declare function isResolvedEngineUsableForRequest(engine: AgentEngine, options?: {
     apiKey?: string;
+    credentialIdentity?: BuilderCredentialLookupIdentity;
 }): Promise<boolean>;
 export interface ResolveEngineConfig {
     /** Explicit engine name or instance from createAgentChatPlugin options */
@@ -186,6 +190,8 @@ export interface ResolveEngineConfig {
     model?: string;
     /** App/template id used for org-scoped per-app model defaults. */
     appId?: string;
+    /** Verified owner identity for request-scoped Builder credential capture. */
+    credentialIdentity?: BuilderCredentialLookupIdentity;
 }
 /**
  * Engine name a caller explicitly selected, when {@link resolveEngine} will

package/dist/agent/engine/registry.js

@@ -401,20 +401,26 @@ function shouldTraceEngineDetection() {
  * `/builder/status` resolves them via the same request org context, and the
  * chat engine picker must not disagree with that card.
  */
-export async function detectEngineFromUserSecrets() {
+export async function detectEngineFromUserSecrets(identity) {
     const traceLookup = shouldTraceEngineDetection();
-    let email;
-    let orgId;
+    let email = identity?.userEmail?.trim() || undefined;
+    let orgId = identity?.orgId;
     try {
         const { getRequestUserEmail, getRequestOrgId } = await import("../../server/request-context.js");
-        email = getRequestUserEmail();
-        orgId = getRequestOrgId();
+        email ??= getRequestUserEmail();
+        if (orgId === undefined)
+            orgId = getRequestOrgId();
     }
     catch {
+        if (!email) {
+            if (traceLookup) {
+                console.log(`[engine-detect] result=null reason=no-request-context email=(unknown) orgId=(unknown)`);
+            }
+            return null;
+        }
         if (traceLookup) {
-            console.log(`[engine-detect] result=null reason=no-request-context email=(unknown) orgId=(unknown)`);
+            console.log(`[engine-detect] request context unavailable; using explicit identity email=${email} orgId=${orgId ?? "(none)"}`);
         }
-        return null;
     }
     if (!email) {
         if (traceLookup) {
@@ -427,8 +433,9 @@ export async function detectEngineFromUserSecrets() {
             return false;
         if (entry.requiredEnvVars.length === 0)
             return false;
-        if (entry.name === "builder")
-            return hasUsableBuilderConnection();
+        if (entry.name === "builder") {
+            return hasUsableBuilderConnection(identity);
+        }
         for (const key of entry.requiredEnvVars) {
             // A throw here means the credential store could not be read. Let it
             // propagate: swallowing it reports "no provider connected" to a user
@@ -520,8 +527,8 @@ async function resolveProviderBaseUrl(envVar) {
  * keeps that distinction instead of reporting "connect a provider" to a user
  * whose org-shared keys exist but were unreadable.
  */
-async function hasUsableBuilderConnection() {
-    const creds = await resolveBuilderCredentialsDetailed();
+async function hasUsableBuilderConnection(identity) {
+    const creds = await resolveBuilderCredentialsDetailed(identity);
     assertCredentialStoreReadable(creds);
     return Boolean(creds.privateKey && creds.publicKey);
 }
@@ -567,7 +574,7 @@ async function apiKeyBelongsToDifferentProvider(apiKey, selectedEntry) {
     }
     return false;
 }
-async function engineCreateConfigForEntry(entry, apiKey, extra, preferResolvedCredential = false, apiKeyEnvVar) {
+async function engineCreateConfigForEntry(entry, apiKey, extra, preferResolvedCredential = false, apiKeyEnvVar, credentialIdentity) {
     const safeExtra = { ...(extra ?? {}) };
     let matchingApiKey = apiKey;
     // A declared provenance settles the question without inspecting values: a
@@ -632,6 +639,25 @@ async function engineCreateConfigForEntry(entry, apiKey, extra, preferResolvedCr
                 safeExtra.baseUrl = baseUrl;
         }
     }
+    if (entry.name === "builder" &&
+        (credentialIdentity !== undefined || safeExtra.credentials == null)) {
+        // Builder authentication is a private/public key pair, not the single
+        // provider key carried by ResolveEngineConfig. Capture the scoped pair
+        // while the verified request identity is available so a later stream or
+        // detached run cannot resolve credentials from the wrong ambient context.
+        const creds = await resolveBuilderCredentialsDetailed(credentialIdentity);
+        assertCredentialStoreReadable(creds);
+        if (credentialIdentity !== undefined ||
+            creds.source !== null ||
+            creds.lookupFailed) {
+            safeExtra.credentials = {
+                privateKey: creds.privateKey,
+                publicKey: creds.publicKey,
+                userId: creds.userId,
+                orgName: creds.orgName,
+            };
+        }
+    }
     return engineCreateConfig(entry, matchingApiKey, safeExtra);
 }
 /**
@@ -661,15 +687,16 @@ export function isStoredEngineUsable(stored, entry) {
  * deploy env vars; this async helper is what request-time routes should use
  * when deciding whether a stored engine can actually run for the current user.
  */
-export async function isStoredEngineUsableForRequest(stored, entry) {
+export async function isStoredEngineUsableForRequest(stored, entry, options = {}) {
     if (!isAgentEnginePackageInstalled(entry))
         return false;
     if (isAgentEngineSettingConfigured(stored))
         return true;
     if (entry.requiredEnvVars.length === 0)
         return true;
-    if (entry.name === "builder")
-        return hasUsableBuilderConnection();
+    if (entry.name === "builder") {
+        return hasUsableBuilderConnection(options.credentialIdentity);
+    }
     for (const key of entry.requiredEnvVars) {
         if (!(await resolveUsableProviderSecret(key)))
             return false;
@@ -692,8 +719,9 @@ export async function isResolvedEngineUsableForRequest(engine, options = {}) {
         return false;
     if (entry.requiredEnvVars.length === 0)
         return true;
-    if (entry.name === "builder")
-        return hasUsableBuilderConnection();
+    if (entry.name === "builder") {
+        return hasUsableBuilderConnection(options.credentialIdentity);
+    }
     if (options.apiKey?.trim()) {
         const key = entry.requiredEnvVars[0];
         if (!key)
@@ -776,7 +804,7 @@ export async function getConfiguredEngineNameForRequest(options = {}) {
  * 7. Default "anthropic" (requires ANTHROPIC_API_KEY)
  */
 export async function resolveEngine(config) {
-    const { engineOption, apiKey, apiKeyEnvVar, model: _model, appId } = config;
+    const { engineOption, apiKey, apiKeyEnvVar, model: _model, appId, credentialIdentity, } = config;
     // 1. Explicit instance passed directly
     if (engineOption &&
         typeof engineOption === "object" &&
@@ -792,7 +820,7 @@ export async function resolveEngine(config) {
         if (!entry)
             throw new Error(`[agent-engine] Unknown engine: "${name}". Registered: ${[..._registry.keys()].join(", ")}`);
         assertAgentEnginePackageInstalled(entry);
-        return entry.create(await engineCreateConfigForEntry(entry, apiKey, engineConfig, false, apiKeyEnvVar));
+        return entry.create(await engineCreateConfigForEntry(entry, apiKey, engineConfig, false, apiKeyEnvVar, credentialIdentity));
     }
     // 3. Explicit string name from options
     if (typeof engineOption === "string") {
@@ -800,7 +828,7 @@ export async function resolveEngine(config) {
         if (!entry)
             throw new Error(`[agent-engine] Unknown engine: "${engineOption}". Registered: ${[..._registry.keys()].join(", ")}`);
         assertAgentEnginePackageInstalled(entry);
-        return entry.create(await engineCreateConfigForEntry(entry, apiKey, undefined, false, apiKeyEnvVar));
+        return entry.create(await engineCreateConfigForEntry(entry, apiKey, undefined, false, apiKeyEnvVar, credentialIdentity));
     }
     // 4. Env var — explicit engine name override
     const envEngine = process.env.AGENT_ENGINE;
@@ -808,14 +836,17 @@ export async function resolveEngine(config) {
         const entry = _registry.get(envEngine);
         if (entry) {
             assertAgentEnginePackageInstalled(entry);
-            return entry.create(await engineCreateConfigForEntry(entry, apiKey, undefined, true, apiKeyEnvVar));
+            return entry.create(await engineCreateConfigForEntry(entry, apiKey, undefined, true, apiKeyEnvVar, credentialIdentity));
         }
     }
     const appDefault = await getAgentAppModelDefaultForCurrentRequest(appId);
     if (appDefault?.engine) {
         const entry = _registry.get(appDefault.engine);
-        if (entry && (await isStoredEngineUsableForRequest(appDefault, entry))) {
-            return entry.create(await engineCreateConfigForEntry(entry, apiKey, undefined, true, apiKeyEnvVar));
+        if (entry &&
+            (await isStoredEngineUsableForRequest(appDefault, entry, {
+                credentialIdentity,
+            }))) {
+            return entry.create(await engineCreateConfigForEntry(entry, apiKey, undefined, true, apiKeyEnvVar, credentialIdentity));
         }
     }
     let stored = null;
@@ -829,7 +860,7 @@ export async function resolveEngine(config) {
     // (Builder OAuth callback + "paste your own key" settings flow write here,
     // not env). Stored/app defaults are checked first so an explicit provider
     // selection can override a connected Builder account.
-    const detectedFromUser = await detectEngineFromUserSecrets();
+    const detectedFromUser = await detectEngineFromUserSecrets(credentialIdentity);
     // 6. Settings store — only when the stored row's API key is reachable.
     // This explicit selection beats automatic Builder detection so users can
     // switch away from Builder credits by saving/applying their own provider key.
@@ -838,26 +869,29 @@ export async function resolveEngine(config) {
     const storedConfig = storedRaw?.config;
     if (storedRaw && typeof storedEngine === "string") {
         const entry = _registry.get(storedEngine);
-        if (entry && (await isStoredEngineUsableForRequest(storedRaw, entry))) {
-            return entry.create(await engineCreateConfigForEntry(entry, apiKey, stripInlineApiKeyConfig(storedConfig), true, apiKeyEnvVar));
+        if (entry &&
+            (await isStoredEngineUsableForRequest(storedRaw, entry, {
+                credentialIdentity,
+            }))) {
+            return entry.create(await engineCreateConfigForEntry(entry, apiKey, stripInlineApiKeyConfig(storedConfig), true, apiKeyEnvVar, credentialIdentity));
         }
     }
     if (detectedFromUser) {
-        return detectedFromUser.create(await engineCreateConfigForEntry(detectedFromUser, apiKey, undefined, true, apiKeyEnvVar));
+        return detectedFromUser.create(await engineCreateConfigForEntry(detectedFromUser, apiKey, undefined, true, apiKeyEnvVar, credentialIdentity));
     }
     // 8. Auto-detect from any provider env var — so just dropping a key in
     // .env works without also setting AGENT_ENGINE. Skip keys with active
     // auth-failure markers so a rejected deploy key cannot permanently win.
     const detected = await detectEngineFromEnvForRequest();
     if (detected) {
-        return detected.create(await engineCreateConfigForEntry(detected, apiKey, undefined, true, apiKeyEnvVar));
+        return detected.create(await engineCreateConfigForEntry(detected, apiKey, undefined, true, apiKeyEnvVar, credentialIdentity));
     }
     // 9. Default: anthropic
     const anthropicEntry = _registry.get("anthropic");
     if (!anthropicEntry) {
         throw new Error("[agent-engine] Default Anthropic engine is not registered. Did builtin.ts fail to load?");
     }
-    return anthropicEntry.create(await engineCreateConfigForEntry(anthropicEntry, apiKey, undefined, true, apiKeyEnvVar));
+    return anthropicEntry.create(await engineCreateConfigForEntry(anthropicEntry, apiKey, undefined, true, apiKeyEnvVar, credentialIdentity));
 }
 /**
  * Read the user-selected model for an engine from the `agent-engine` setting.

package/dist/agent/production-agent.js

@@ -5978,6 +5978,10 @@ export function createProductionAgentHandler(options) {
         // DIAGNOSTIC-ONLY: bracket engine resolution (Builder credential / app-default
         // settings reads inside resolveEngine).
         workerStep("engine_start");
+        const credentialIdentity = {
+            userEmail: ownerEmail,
+            orgId: getRequestOrgId(),
+        };
         let engine;
         try {
             engine = await resolveEngine({
@@ -5986,6 +5990,7 @@ export function createProductionAgentHandler(options) {
                 apiKeyEnvVar: effectiveApiKeyEnvVar,
                 model: configuredModel,
                 appId: options.appId,
+                credentialIdentity,
             });
         }
         catch {
@@ -5993,6 +5998,7 @@ export function createProductionAgentHandler(options) {
                 apiKey: effectiveApiKey,
                 apiKeyEnvVar: effectiveApiKeyEnvVar,
                 appId: options.appId,
+                credentialIdentity,
             });
         }
         // DIAGNOSTIC-ONLY: engine resolution finished.
@@ -6056,6 +6062,7 @@ export function createProductionAgentHandler(options) {
         console.log(`[agent-chat] resolved engine=${engine.name} model=${effectiveModel} requestModel=${requestModel ?? "(none)"} requestEngine=${requestEngine ?? "(none)"} modelSource=${modelSelectionSource} turnId=${requestTurnId ?? "(none)"}`);
         if (!(await isResolvedEngineUsableForRequest(engine, {
             apiKey: effectiveApiKey,
+            credentialIdentity,
         }))) {
             setResponseHeader(event, "Content-Type", "text/event-stream");
             setResponseHeader(event, "Cache-Control", "no-cache");

package/dist/agent/run-manager.d.ts

@@ -164,10 +164,11 @@ export declare const DEFAULT_COMPLETED_RUN_RETENTION_MS: number;
  */
 export declare const DEFAULT_ERRORED_RUN_RETENTION_MS: number;
 /**
- * How recently a terminal run must have started for `/runs/active` to surface
- * it. Reconnect after this window won't replay the run — typical real-world
- * disconnects resolve in seconds, so 10 minutes is generous while keeping us
- * from resurrecting ancient turns when the user reopens an old thread.
+ * How recently a terminal run must have completed for `/runs/active` to surface
+ * it. This must outlast the durable browser watchdog (13 minutes) and the
+ * in-flight reader watchdog (15 minutes) so a quiet event stream can detach
+ * and still replay a run that completed while the browser was waiting.
+ * Reconnect after this window won't replay the run.
  */
 export declare const TERMINAL_RUN_RECONNECT_WINDOW_MS: number;
 /** Fast poll cadence while a SQL-backed SSE subscription is actively receiving rows. */

package/dist/agent/run-manager.js

@@ -180,12 +180,13 @@ export const DEFAULT_COMPLETED_RUN_RETENTION_MS = 24 * 60 * 60 * 1000;
  */
 export const DEFAULT_ERRORED_RUN_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
 /**
- * How recently a terminal run must have started for `/runs/active` to surface
- * it. Reconnect after this window won't replay the run — typical real-world
- * disconnects resolve in seconds, so 10 minutes is generous while keeping us
- * from resurrecting ancient turns when the user reopens an old thread.
+ * How recently a terminal run must have completed for `/runs/active` to surface
+ * it. This must outlast the durable browser watchdog (13 minutes) and the
+ * in-flight reader watchdog (15 minutes) so a quiet event stream can detach
+ * and still replay a run that completed while the browser was waiting.
+ * Reconnect after this window won't replay the run.
  */
-export const TERMINAL_RUN_RECONNECT_WINDOW_MS = 10 * 60 * 1000;
+export const TERMINAL_RUN_RECONNECT_WINDOW_MS = 20 * 60 * 1000;
 /** Fast poll cadence while a SQL-backed SSE subscription is actively receiving rows. */
 export const SQL_SUBSCRIPTION_ACTIVE_POLL_MS = 125;
 /** Baseline SQL-backed SSE poll cadence when the run is idle. */

package/dist/cli/claude-code-participant.d.ts

@@ -42,6 +42,7 @@ export interface RunClaudeCodeParticipantOptions {
     prompt: string;
     cwd: string;
     model?: string;
+    effort?: string;
     session?: ClaudeCodeParticipantSession;
     /** Either the fixed CLI name or an absolute executable path for packaged apps. */
     command?: string;
@@ -71,6 +72,6 @@ export interface ClaudeCodeSubscriptionStatusOptions {
 }
 export declare function readClaudeCodeSubscriptionStatus(options?: ClaudeCodeSubscriptionStatusOptions): Promise<ClaudeCodeSubscriptionStatus>;
 export declare function runClaudeCodeParticipant(options: RunClaudeCodeParticipantOptions): Promise<ClaudeCodeParticipantResult>;
-export declare function buildClaudeCodeParticipantArgs(options: Pick<RunClaudeCodeParticipantOptions, "role" | "model" | "session">): string[];
+export declare function buildClaudeCodeParticipantArgs(options: Pick<RunClaudeCodeParticipantOptions, "role" | "model" | "effort" | "session">): string[];
 export declare const CLAUDE_CODE_PARTICIPANT_TESTED_VERSION = "2.1.208";
 export {};

package/dist/cli/claude-code-participant.js

@@ -102,6 +102,9 @@ export function buildClaudeCodeParticipantArgs(options) {
     const model = readString(options.model);
     if (model)
         args.push("--model", model);
+    const effort = normalizeClaudeEffort(options.effort);
+    if (effort)
+        args.push("--effort", effort);
     const sessionId = readString(options.session?.sessionId);
     const resumeSessionId = readString(options.session?.resumeSessionId);
     if (sessionId)
@@ -112,6 +115,22 @@ export function buildClaudeCodeParticipantArgs(options) {
         args.push("--no-session-persistence");
     return args;
 }
+function normalizeClaudeEffort(effort) {
+    switch (effort) {
+        case "low":
+        case "medium":
+        case "high":
+        case "max":
+            return effort;
+        case "minimal":
+        case "none":
+            return "low";
+        case "xhigh":
+            return "high";
+        default:
+            return undefined;
+    }
+}
 function collectClaudeCodeParticipantResult(child, options) {
     const maxEvents = boundedLimit(options.maxEvents, DEFAULT_MAX_EVENTS);
     const maxStreamBytes = boundedLimit(options.maxStreamBytes, DEFAULT_MAX_STREAM_BYTES);