@agent-native/core 0.155.0 → 0.157.0

package/dist/server/agent-chat-plugin.js

@@ -12,7 +12,7 @@ import { AGENT_CHAT_BACKGROUND_RUN_FIELD, AGENT_CHAT_PROCESS_RUN_PATH, backgroun
 import { resolveEngine, createAnthropicEngine, getStoredModelForEngine, normalizeModelForEngine, resolveDelegatedRunModel, getAgentEngineEntry, isAgentEnginePackageInstalled, isStoredEngineUsableForRequest, listAgentEngines, registerBuiltinEngines, } from "../agent/engine/index.js";
 import { SYSTEM_PROMPT_CACHE_SPLIT } from "../agent/engine/prompt-cache.js";
 import { PROVIDER_TO_ENV } from "../agent/engine/provider-env-vars.js";
-import { createProductionAgentHandler, actionsToEngineTools, executeAgentToolCall, toolCallCacheKey, getActiveRunForThreadAsync, abortRunDurably, abortTurnDurably, subscribeToRun, } from "../agent/production-agent.js";
+import { createProductionAgentHandler, actionsToEngineTools, executeAgentToolCall, filterActionsByAllowedNames, readPersistedActionSurface, toolCallCacheKey, getActiveRunForThreadAsync, abortRunDurably, abortTurnDurably, subscribeToRun, } from "../agent/production-agent.js";
 import { callerHasRunAccess, callerHasThreadAccess, } from "../agent/run-ownership.js";
 import { markTurnAborted, readBackgroundRunClaim } from "../agent/run-store.js";
 import { buildCurrentTimeUserContext, buildRuntimeContextPrompt, } from "../agent/runtime-context.js";
@@ -208,6 +208,46 @@ export async function resolveA2ARecoverableArtifactSecret(orgId = getRequestOrgI
 export function buildLeanRunPolicyPrompt(codeEditingSurfaceRestriction, prodCodeExecPromptNote) {
     return codeEditingSurfaceRestriction + prodCodeExecPromptNote;
 }
+export function filterPromptActionsToSurface(actions, allowedActionNames) {
+    if (!allowedActionNames)
+        return actions;
+    return filterActionsByAllowedNames(actions, allowedActionNames.filter((name) => actions[name]));
+}
+/** Keep late-bound sandbox and data-program bridges on the current request's
+ * authorized registry instead of the plugin's process-wide action catalog. */
+export function filterRuntimeActionsToSurface(actions) {
+    return filterPromptActionsToSurface(actions, getRequestRunContext()?.allowedActionNames);
+}
+/** Remove framework guidance for tools that the request surface does not
+ * expose. The default framework prompt is line-oriented, so dropping the
+ * affected instruction keeps unrelated behavioral guidance intact without
+ * teaching the model names it cannot call. */
+export function filterFrameworkPromptToSurface(prompt, actions, allowedActionNames) {
+    if (!allowedActionNames)
+        return prompt;
+    const allowedNames = new Set(allowedActionNames);
+    const deniedPatterns = Object.keys(actions)
+        .filter((name) => !allowedNames.has(name))
+        .sort((a, b) => b.length - a.length)
+        .map((name) => {
+        const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        return new RegExp(`(^|[^a-z0-9-])${escaped}(?=$|[^a-z0-9-])`);
+    });
+    if (deniedPatterns.length === 0)
+        return prompt;
+    return prompt
+        .split("\n")
+        .filter((line) => !deniedPatterns.some((pattern) => pattern.test(line)))
+        .join("\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .trimEnd();
+}
+export function resolveProductionCodeExecutionForActionSurface(mode, hasRequestScopedSurface) {
+    // A trusted shell can reach action routes outside the native registry, so it
+    // cannot uphold a hard per-request allowlist. Keep sandboxed run-code, whose
+    // bridge is filtered against the current request, as the safe equivalent.
+    return hasRequestScopedSurface && mode === "trusted" ? "sandboxed" : mode;
+}
 /**
  * In-memory rate-limit tracker for `/generate-title`. Keyed by user email,
  * value is recent invocation timestamps within the rolling window. Stale
@@ -892,6 +932,11 @@ export function createAgentChatPlugin(options) {
                     : rawEnvCodeExec === "off"
                         ? "off"
                         : (options?.codeExecution?.production ?? "off");
+            const effectiveProdCodeExec = resolveProductionCodeExecutionForActionSurface(resolvedProdCodeExec, Boolean(options?.resolveActionSurface));
+            if (resolvedProdCodeExec === "trusted" &&
+                effectiveProdCodeExec !== "trusted") {
+                console.warn("[agent-native] Request-scoped action surfaces disable trusted shell tools; using sandboxed code execution instead.");
+            }
             // Forward-declaration for the production code-execution bridge supplier.
             // Must come before the code entries are created so their closures can capture it.
             let prodRunCodeToolActions = {};
@@ -902,11 +947,11 @@ export function createAgentChatPlugin(options) {
             const runCodeTool = await loadRunCodeToolEntries(
             // Supplier is evaluated at invocation time so runtime additions to
             // prodActions (e.g. MCP sync) are visible to the bridge.
-            () => prodRunCodeToolActions, { bridgeTools: options?.codeExecution?.bridgeTools });
+            () => filterRuntimeActionsToSurface(prodRunCodeToolActions), { bridgeTools: options?.codeExecution?.bridgeTools });
             const leanRunCodeTool = await loadRunCodeToolEntries(
             // Lean prompt mode intentionally exposes a much smaller action
             // surface; keep sandbox appAction() calls scoped to that same surface.
-            () => leanRunCodeToolActions, { bridgeTools: options?.codeExecution?.bridgeTools });
+            () => filterRuntimeActionsToSurface(leanRunCodeToolActions), { bridgeTools: options?.codeExecution?.bridgeTools });
             // Full coding tool registry (bash/read/edit/write) for "trusted" prod.
             // In dev mode this is handled separately via devHandler below.
             const prodCodingTools = {};
@@ -935,7 +980,7 @@ export function createAgentChatPlugin(options) {
             // use a late-binding supplier so devRunCodeTool can reference the
             // devActions registry once it is built below (see devHandler block).
             const devRunCodeTool = canToggle
-                ? await loadRunCodeToolEntries(() => devRunCodeToolActions, {
+                ? await loadRunCodeToolEntries(() => filterRuntimeActionsToSurface(devRunCodeToolActions), {
                     bridgeTools: options?.codeExecution?.bridgeTools,
                 })
                 : {};
@@ -946,7 +991,7 @@ export function createAgentChatPlugin(options) {
                 ...templateScripts,
                 ...(canToggle
                     ? devRunCodeTool
-                    : resolvedProdCodeExec !== "off"
+                    : effectiveProdCodeExec !== "off"
                         ? runCodeTool
                         : {}),
             };
@@ -1684,6 +1729,36 @@ export function createAgentChatPlugin(options) {
                 : "";
             const prodActionsPrompt = generateActionsPrompt(templateScripts, "tool", lazyContext ? effectiveInitialToolNames : undefined) + corpusToolsPrompt;
             const devActionsPrompt = generateActionsPrompt({ ...discoveredActions, ...templateScripts }, "cli") + corpusToolsPrompt;
+            const filterPromptActionsForRequest = (actions) => {
+                return filterPromptActionsToSurface(actions, getRequestRunContext()?.allowedActionNames);
+            };
+            const resolveRequestActionsPrompt = (mode) => {
+                const allowedNames = getRequestRunContext()?.allowedActionNames;
+                if (!allowedNames) {
+                    return mode === "tool" ? prodActionsPrompt : devActionsPrompt;
+                }
+                const promptActions = filterPromptActionsForRequest(mode === "tool"
+                    ? templateScripts
+                    : { ...discoveredActions, ...templateScripts });
+                const promptCorpus = filterPromptActionsForRequest(corpusPromptRegistry);
+                return (generateActionsPrompt(promptActions, mode) +
+                    (loadCorpusToolsInitially
+                        ? generateCorpusToolsPrompt(promptCorpus)
+                        : ""));
+            };
+            const leanActionsPrompt = prodActionsPrompt +
+                (a2aAgentDelegationEnabled
+                    ? generateActionsPrompt(callAgentScript, "tool")
+                    : "");
+            const resolveRequestLeanActionsPrompt = () => {
+                const allowedNames = getRequestRunContext()?.allowedActionNames;
+                if (!allowedNames)
+                    return leanActionsPrompt;
+                return generateActionsPrompt(filterPromptActionsForRequest({
+                    ...templateScripts,
+                    ...(a2aAgentDelegationEnabled ? callAgentScript : {}),
+                }), "tool");
+            };
             // Build system prompts — dynamic functions that pre-load resources per-request.
             // Production gets PROD_FRAMEWORK_PROMPT, dev gets DEV_FRAMEWORK_PROMPT.
             // Custom systemPrompt from options overrides the framework default entirely.
@@ -1695,10 +1770,19 @@ export function createAgentChatPlugin(options) {
             // `nativeActionsInDev` or `leanPrompt`), the dev prompt's "invoke
             // template actions via bash" guidance is wrong — use the prod prompt
             // + tool-format action list instead, same as production.
-            const devNative = options?.nativeActionsInDev === true || leanPrompt;
-            const devPrompt = devNative
-                ? prodPrompt
-                : (options?.devSystemPrompt
+            const devNative = options?.nativeActionsInDev === true ||
+                leanPrompt ||
+                Boolean(options?.resolveActionSurface);
+            // Keep legacy names for the composition below
+            const basePrompt = prodPrompt;
+            const getFrameworkPromptActions = () => Object.fromEntries(Object.entries(prodActions).filter(([name]) => !templateScripts[name] && !mcpActionEntries[name]));
+            const resolveRequestBasePrompt = () => (options?.systemPrompt ??
+                filterFrameworkPromptToSurface(lazyContext ? PROD_FRAMEWORK_PROMPT_COMPACT : PROD_FRAMEWORK_PROMPT, getFrameworkPromptActions(), getRequestRunContext()?.allowedActionNames)) + resolveRequestActionsPrompt("tool");
+            const resolveRequestLeanPrompt = () => (options?.systemPrompt ?? "") + resolveRequestLeanActionsPrompt();
+            const resolveRequestDevPrompt = () => {
+                if (devNative)
+                    return resolveRequestBasePrompt();
+                const frameworkPrompt = options?.devSystemPrompt
                     ? options.devSystemPrompt +
                         (options?.systemPrompt ??
                             (lazyContext
@@ -1706,9 +1790,9 @@ export function createAgentChatPlugin(options) {
                                 : PROD_FRAMEWORK_PROMPT))
                     : lazyContext
                         ? DEV_FRAMEWORK_PROMPT_COMPACT
-                        : DEV_FRAMEWORK_PROMPT) + devActionsPrompt;
-            // Keep legacy names for the composition below
-            const basePrompt = prodPrompt;
+                        : DEV_FRAMEWORK_PROMPT;
+                return frameworkPrompt + resolveRequestActionsPrompt("cli");
+            };
             if (mcpOptions.enabled) {
                 // Mount MCP remote server — same action registry as A2A + agent chat
                 const { mountMCP } = await import("../mcp/server.js");
@@ -2245,7 +2329,7 @@ export function createAgentChatPlugin(options) {
             const teamTools = createTeamTools({
                 getOwner: () => requireCurrentRunOwner("spawn or manage sub-agents"),
                 getSystemPrompt: () => getRequestRunContext()?.systemPrompt ?? basePrompt,
-                getActions: buildSubAgentActions,
+                getActions: () => filterRuntimeActionsToSurface(buildSubAgentActions()),
                 getEngine: () => {
                     const runCtx = getRequestRunContext();
                     // Sub-agents must inherit the parent run's resolved key so
@@ -2343,9 +2427,11 @@ export function createAgentChatPlugin(options) {
                 ...mcpActionEntries,
                 // Sandboxed run-code for hosted production when enabled, and for the
                 // app-rendered production-style handler in local dev.
-                ...(canToggle || resolvedProdCodeExec !== "off" ? runCodeTool : {}),
+                ...(canToggle || effectiveProdCodeExec !== "off" ? runCodeTool : {}),
                 // Full coding tools in production when mode is "trusted".
-                ...(!canToggle ? prodCodingTools : {}),
+                ...(!canToggle && effectiveProdCodeExec === "trusted"
+                    ? prodCodingTools
+                    : {}),
             });
             mountRealtimeVoiceRoutes(nitroApp, prodActions, {
                 resolveOrgId: options?.resolveOrgId,
@@ -2393,7 +2479,9 @@ export function createAgentChatPlugin(options) {
                 // Otherwise templates with a minimal prompt can advertise sandboxed
                 // execution in the system prompt while the actual tool registry omits
                 // it.
-                ...(canToggle || resolvedProdCodeExec !== "off" ? leanRunCodeTool : {}),
+                ...(canToggle || effectiveProdCodeExec !== "off"
+                    ? leanRunCodeTool
+                    : {}),
             });
             leanRunCodeToolActions = leanActions;
             // Keep the prod action dict's MCP entries in sync when the manager's
@@ -2410,14 +2498,18 @@ export function createAgentChatPlugin(options) {
             // Lean mode: use only the template's systemPrompt + actions list.
             // Skip resource loading and schema block — those add DB round-trips
             // and tokens that minimal/voice apps don't need.
-            const leanActionsPrompt = prodActionsPrompt +
-                (a2aAgentDelegationEnabled
-                    ? generateActionsPrompt(callAgentScript, "tool")
-                    : "");
-            const leanBasePrompt = (options?.systemPrompt ?? "") + leanActionsPrompt;
             const anonymousReadOnlyPrompt = (options?.systemPrompt ?? PROD_FRAMEWORK_PROMPT_COMPACT) +
                 generateActionsPrompt(filterReadOnlyActions(templateScripts), "tool", lazyContext ? effectiveInitialToolNames : undefined) +
                 "\n\nYou are answering from a public shared page. Treat the visible resource as read-only: do not create, edit, delete, comment on, share, or otherwise mutate app data. If the user asks for a change, describe what you would change or suggest signing in to edit.";
+            const resolveAnonymousReadOnlyPrompt = () => {
+                if (!getRequestRunContext()?.allowedActionNames) {
+                    return anonymousReadOnlyPrompt;
+                }
+                return ((options?.systemPrompt ??
+                    filterFrameworkPromptToSurface(PROD_FRAMEWORK_PROMPT_COMPACT, getFrameworkPromptActions(), getRequestRunContext()?.allowedActionNames)) +
+                    generateActionsPrompt(filterPromptActionsForRequest(filterReadOnlyActions(templateScripts)), "tool") +
+                    "\n\nYou are answering from a public shared page. Treat the visible resource as read-only: do not create, edit, delete, comment on, share, or otherwise mutate app data. If the user asks for a change, describe what you would change or suggest signing in to edit.");
+            };
             // Per-request preamble shared by both prod and dev handlers. Resolves
             // owner + user API key onto the AsyncLocalStorage run context so
             // downstream tool closures (automation, fetch, team) read the
@@ -2585,8 +2677,8 @@ When the user asks to add a feature, edit a component, fix a bug in the app itse
 Non-code requests are still fine on this surface: read data, navigate the UI, summarize, search, create/update extensions (sandboxed Alpine.js mini-apps stored in SQL), and call template actions. The restriction is specifically about direct edits to the host app's own source files.
 </app-rendered-chat-no-direct-code-edits>`;
             // System-prompt note appended when production code execution is enabled.
-            const prodCodeExecPromptNote = !canToggle && resolvedProdCodeExec !== "off"
-                ? resolvedProdCodeExec === "trusted"
+            const prodCodeExecPromptNote = !canToggle && effectiveProdCodeExec !== "off"
+                ? effectiveProdCodeExec === "trusted"
                     ? "\n\n<code-execution-mode>Full shell access is enabled (trusted mode). You have bash, read, edit, write, and run-code tools available. Use bash for file discovery, running tests and builds, and project CLIs. Use run-code for sandboxed JavaScript data processing: provider/API pagination, joins, classification, aggregation, and large-response reduction. Use tool-orchestration for short bounded fan-out or reduction over read-only tools. Use `pnpm action <name>` in bash to invoke registered app actions from the shell.</code-execution-mode>"
                     : "\n\n<code-execution-mode>Sandboxed code execution is enabled. Use tool-orchestration for short bounded fan-out, joins, and reduction over read-only tools. Use run-code when you need its broader provider/web helpers, workspace staging, or durable background execution. In either tool, authenticated calls go through the provided host globals and results should be reduced before printing.</code-execution-mode>"
                 : "";
@@ -2594,6 +2686,10 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 actions: leanPrompt ? leanActions : prodActions,
                 systemPrompt: async (event) => {
                     const { owner, extra } = await prepareRun(event);
+                    const requestActionsPrompt = resolveRequestActionsPrompt("tool");
+                    const requestLeanActionsPrompt = resolveRequestLeanActionsPrompt();
+                    const requestBasePrompt = resolveRequestBasePrompt();
+                    const requestLeanPrompt = resolveRequestLeanPrompt();
                     const runtimeContext = runtimeContextForEvent(event);
                     const codeEditingSurfaceRestriction = shouldBlockInProductCodeEditing(event)
                         ? APP_RENDERED_CHAT_NO_DIRECT_CODE_PROMPT
@@ -2612,8 +2708,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         const leanRunPolicyPrompt = buildLeanRunPolicyPrompt(codeEditingSurfaceRestriction, prodCodeExecPromptNote);
                         const resources = await loadResourcesForPrompt(owner, true, options?.appId, undefined, { disabledFrameworkGroups });
                         await emitContextXraySystemSections(event, {
-                            frameworkPrompt: leanBasePrompt.slice(0, Math.max(0, leanBasePrompt.length - leanActionsPrompt.length)),
-                            actionsPrompt: leanActionsPrompt,
+                            frameworkPrompt: requestLeanPrompt.slice(0, Math.max(0, requestLeanPrompt.length - requestLeanActionsPrompt.length)),
+                            actionsPrompt: requestLeanActionsPrompt,
                             additionalFramework: leanRunPolicyPrompt,
                             resources,
                             extra,
@@ -2621,7 +2717,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             runtimeContext,
                         });
                         return setSystemPromptOnContext(buildLeanSystemPrompt({
-                            basePrompt: leanBasePrompt,
+                            basePrompt: requestLeanPrompt,
                             additionalFramework: leanRunPolicyPrompt,
                             cacheSplit: SYSTEM_PROMPT_CACHE_SPLIT,
                             resources,
@@ -2637,8 +2733,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         ? ""
                         : await buildSchemaBlock(owner, databaseToolsMode);
                     await emitContextXraySystemSections(event, {
-                        frameworkPrompt: basePrompt.slice(0, Math.max(0, basePrompt.length - prodActionsPrompt.length)),
-                        actionsPrompt: prodActionsPrompt,
+                        frameworkPrompt: requestBasePrompt.slice(0, Math.max(0, requestBasePrompt.length - requestActionsPrompt.length)),
+                        actionsPrompt: requestActionsPrompt,
                         resources,
                         schemaBlock,
                         extra,
@@ -2646,7 +2742,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         runtimeContext,
                         additionalFramework: codeEditingSurfaceRestriction + prodCodeExecPromptNote,
                     });
-                    return setSystemPromptOnContext(basePrompt +
+                    return setSystemPromptOnContext(requestBasePrompt +
                         SYSTEM_PROMPT_CACHE_SPLIT +
                         resources +
                         schemaBlock +
@@ -2708,6 +2804,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         message,
                     };
                 },
+                resolveActionSurface: options?.resolveActionSurface,
                 skipFilesContext,
                 initialToolNames: effectiveInitialToolNames,
                 ...(options?.toolLimits ? { toolLimits: options.toolLimits } : {}),
@@ -2741,12 +2838,13 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     actions: anonymousReadOnlyActions,
                     systemPrompt: async (event) => {
                         const { extra } = await prepareRun(event);
+                        const requestAnonymousPrompt = resolveAnonymousReadOnlyPrompt();
                         await emitContextXraySystemSections(event, {
-                            frameworkPrompt: anonymousReadOnlyPrompt,
+                            frameworkPrompt: requestAnonymousPrompt,
                             extra,
                             runtimeContext: runtimeContextForEvent(event),
                         });
-                        return setSystemPromptOnContext(anonymousReadOnlyPrompt +
+                        return setSystemPromptOnContext(requestAnonymousPrompt +
                             extra +
                             runtimeContextForEvent(event));
                     },
@@ -2756,6 +2854,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     ...resolveInteractiveAgentRunOptions(options),
                     finalResponseGuard: options?.finalResponseGuard,
                     prepareRequest: options?.prepareRequest,
+                    resolveActionSurface: options?.resolveActionSurface,
                     skipFilesContext: true,
                     initialToolNames: effectiveInitialToolNames,
                     onEngineResolved: (engine, model) => {
@@ -2847,6 +2946,10 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     actions: devActions,
                     systemPrompt: async (event) => {
                         const { owner, extra } = await prepareRun(event);
+                        const requestActionsPrompt = resolveRequestActionsPrompt(devNative ? "tool" : "cli");
+                        const requestLeanActionsPrompt = resolveRequestLeanActionsPrompt();
+                        const requestLeanPrompt = resolveRequestLeanPrompt();
+                        const requestDevPrompt = resolveRequestDevPrompt();
                         const runtimeContext = runtimeContextForEvent(event);
                         const modelOverlay = resolveModelOverlay();
                         // Stable-first ordering: runtimeContext (day-granular) is
@@ -2856,15 +2959,15 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         if (leanPrompt) {
                             const resources = await loadResourcesForPrompt(owner, true, options?.appId, undefined, { disabledFrameworkGroups });
                             await emitContextXraySystemSections(event, {
-                                frameworkPrompt: leanBasePrompt.slice(0, Math.max(0, leanBasePrompt.length - leanActionsPrompt.length)),
-                                actionsPrompt: leanActionsPrompt,
+                                frameworkPrompt: requestLeanPrompt.slice(0, Math.max(0, requestLeanPrompt.length - requestLeanActionsPrompt.length)),
+                                actionsPrompt: requestLeanActionsPrompt,
                                 resources,
                                 extra,
                                 modelOverlay,
                                 runtimeContext,
                             });
                             return setSystemPromptOnContext(buildLeanSystemPrompt({
-                                basePrompt: leanBasePrompt,
+                                basePrompt: requestLeanPrompt,
                                 resources,
                                 extra,
                                 modelOverlay,
@@ -2876,17 +2979,15 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             ? ""
                             : await buildSchemaBlock(owner, databaseToolsMode);
                         await emitContextXraySystemSections(event, {
-                            frameworkPrompt: devNative
-                                ? basePrompt.slice(0, Math.max(0, basePrompt.length - prodActionsPrompt.length))
-                                : devPrompt.slice(0, Math.max(0, devPrompt.length - devActionsPrompt.length)),
-                            actionsPrompt: devNative ? prodActionsPrompt : devActionsPrompt,
+                            frameworkPrompt: requestDevPrompt.slice(0, Math.max(0, requestDevPrompt.length - requestActionsPrompt.length)),
+                            actionsPrompt: requestActionsPrompt,
                             resources,
                             schemaBlock,
                             extra,
                             modelOverlay,
                             runtimeContext,
                         });
-                        return setSystemPromptOnContext(devPrompt +
+                        return setSystemPromptOnContext(requestDevPrompt +
                             resources +
                             schemaBlock +
                             extra +
@@ -2913,6 +3014,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         }
                         return options?.prepareRequest?.(details);
                     },
+                    resolveActionSurface: options?.resolveActionSurface,
                     skipFilesContext,
                     initialToolNames: effectiveInitialToolNames,
                     ...(options?.toolLimits ? { toolLimits: options.toolLimits } : {}),
@@ -3085,7 +3187,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             // just told, and filtering to the full set would only add a
                             // tool-search schema with nothing new for it to find.
                             return {
-                                baseSystemPrompt: basePrompt,
+                                baseSystemPrompt: filterFrameworkPromptToSurface(basePrompt, prodActions, payload.allowedActionNames),
                                 actions: buildSubAgentActions(),
                                 engine,
                                 model,
@@ -4793,7 +4895,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     // helper expands that owner into the same user/org AsyncLocalStorage
                     // context the foreground request uses, so credential and data scoping
                     // stay aligned.
-                    await seedBackgroundAgentRunOwnerContext(event, prepared.runId);
+                    const persistedSurface = readPersistedActionSurface(workerBody, "__resolvedActionSurface");
+                    await seedBackgroundAgentRunOwnerContext(event, prepared.runId, persistedSurface?.orgId);
                     return await invokeAgentChatHandler(event);
                 }
                 catch (err) {

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-run-context.d.ts

@@ -4,6 +4,12 @@ export type AgentRunOwnerContext = {
     owner: string;
     anonymous: boolean;
     name?: string;
+    /**
+     * Trusted org binding for a cookieless durable worker. Presence matters:
+     * `null` means the authenticated foreground request had no org and must not
+     * fall back to another membership during worker re-entry.
+     */
+    orgId?: string | null;
 };
 export declare const AGENT_RUN_OWNER_CONTEXT_KEY = "__agentNativeOwnerContext";
 type AnonymousOwnerResolver = (event: H3Event) => string | null | Promise<string | null>;
@@ -20,7 +26,7 @@ export declare function readAgentRunTimezone(event: H3Event): string | undefined
  */
 export declare function readBrowserSessionIdHeader(event: H3Event): string | undefined;
 export declare function seedAgentRunOwnerContext(event: H3Event, ownerContext: AgentRunOwnerContext): AgentRunOwnerContext;
-export declare function seedBackgroundAgentRunOwnerContext(event: H3Event, runId: string): Promise<AgentRunOwnerContext | null>;
+export declare function seedBackgroundAgentRunOwnerContext(event: H3Event, runId: string, orgId?: string | null): Promise<AgentRunOwnerContext | null>;
 export declare function resolveAgentRunOwnerContext(event: H3Event, options?: {
     anonymousOwner?: AnonymousOwnerResolver;
 }): Promise<AgentRunOwnerContext>;

package/dist/server/agent-run-context.js

@@ -67,13 +67,17 @@ export function seedAgentRunOwnerContext(event, ownerContext) {
         ownerContext;
     return ownerContext;
 }
-export async function seedBackgroundAgentRunOwnerContext(event, runId) {
+export async function seedBackgroundAgentRunOwnerContext(event, runId, orgId) {
     try {
         const { getRunOwnerEmail } = await import("../agent/run-store.js");
         const owner = await getRunOwnerEmail(runId);
         if (!owner)
             return null;
-        return seedAgentRunOwnerContext(event, { owner, anonymous: false });
+        return seedAgentRunOwnerContext(event, {
+            owner,
+            anonymous: false,
+            ...(orgId !== undefined ? { orgId } : {}),
+        });
     }
     catch {
         return null;
@@ -105,6 +109,9 @@ export async function resolveAgentRunOwnerContext(event, options = {}) {
     });
 }
 export async function resolveAgentRunOrgId(options) {
+    if (Object.prototype.hasOwnProperty.call(options.ownerContext, "orgId")) {
+        return normalizeId(options.ownerContext.orgId);
+    }
     let resolvedOrgId;
     if (options.resolveOrgId) {
         resolvedOrgId = normalizeId(await options.resolveOrgId(options.event));

package/dist/server/agent-teams-run-queue.d.ts

@@ -31,6 +31,9 @@ export interface AgentTeamRunPayload {
     parentRunId?: string;
     /** Display name for the sub-agent tab. */
     name?: string;
+    /** Exact action registry captured when the parent spawned this task. Older
+     * queue rows omit it and retain their original unscoped behavior. */
+    allowedActionNames?: string[];
     /** Logical-turn id, stable across continuation chunks so durable assistant
      * messages fold into one. */
     turnId: string;

package/dist/server/agent-teams.js

@@ -17,7 +17,7 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { applyAgentTextEventToBuffer } from "../a2a/response-text.js";
 import { resolveMainChatMaxOutputTokens } from "../agent/engine/output-tokens.js";
-import { actionsToEngineTools, filterInitialEngineTools, resolveAgentRequestReasoningEffort, } from "../agent/production-agent.js";
+import { actionsToEngineTools, filterActionsByAllowedNames, filterInitialEngineTools, readPersistedAllowedActionNames, resolveAgentRequestReasoningEffort, } from "../agent/production-agent.js";
 import { runAgentLoop, appendAgentLoopContinuation, } from "../agent/production-agent.js";
 import { abortRun, getActiveRunForThreadAsync, getRun, startRun, subscribeToRun, } from "../agent/run-manager.js";
 import { getRunEventsSince } from "../agent/run-store.js";
@@ -31,7 +31,7 @@ import { describeDbError } from "../db/client.js";
 import { resolveOrgIdForEmail } from "../org/context.js";
 import { completeRun as completeProgressRun, startRun as startProgressRun, updateRunProgress, } from "../progress/registry.js";
 import { enqueueAgentTeamRun, claimAgentTeamRun, touchAgentTeamRun, bumpAgentTeamContinuation, completeAgentTeamRun, getAgentTeamRunDispatchState, listActiveAgentTeamTaskIdsForOwner, MAX_AGENT_TEAM_CONTINUATIONS, MAX_AGENT_TEAM_NO_PROGRESS_CONTINUATIONS, RUN_DISPATCH_STUCK_AFTER_MS, RUN_PROCESSING_STUCK_AFTER_MS, } from "./agent-teams-run-queue.js";
-import { getRequestUserEmail, runWithRequestContext, } from "./request-context.js";
+import { getRequestOrgId, getRequestRunContext, getRequestUserEmail, hasRequestContext, runWithRequestContext, } from "./request-context.js";
 import { fireInternalDispatch } from "./self-dispatch.js";
 /**
  * Ambient delegation depth for the agent whose run is currently executing.
@@ -972,12 +972,17 @@ export async function spawnTask(opts) {
     // (integrations/webhook-handler.ts). Execution happens in `processAgentTeamRun`,
     // invoked by the `/_agent-native/agent-teams/_process-run` route mounted
     // inside the agent-chat plugin (where the action/prompt/engine closures live).
-    let orgId = null;
-    try {
-        orgId = (await resolveOrgIdForEmail(opts.ownerEmail)) ?? null;
+    let orgId;
+    if (hasRequestContext()) {
+        orgId = getRequestOrgId() ?? null;
     }
-    catch {
-        orgId = null;
+    else {
+        try {
+            orgId = await resolveOrgIdForEmail(opts.ownerEmail);
+        }
+        catch {
+            orgId = null;
+        }
     }
     const payload = {
         description: opts.description,
@@ -986,6 +991,9 @@ export async function spawnTask(opts) {
         ...(opts.parentThreadId ? { parentThreadId: opts.parentThreadId } : {}),
         ...(opts.parentRunId ? { parentRunId: opts.parentRunId } : {}),
         ...(opts.name ? { name: opts.name } : {}),
+        ...(getRequestRunContext()?.allowedActionNames !== undefined
+            ? { allowedActionNames: Object.keys(opts.actions) }
+            : {}),
         // Stable across continuation chunks so the durable assistant message folds.
         turnId: runId,
     };
@@ -1171,9 +1179,19 @@ export async function processAgentTeamRun(opts) {
     const claimed = await claimAgentTeamRun(opts.taskId);
     if (!claimed)
         return { ok: true, skipped: "already-claimed-or-missing" };
+    const persistedAllowedActionNames = readPersistedAllowedActionNames(claimed.payload);
+    const payload = persistedAllowedActionNames === undefined
+        ? claimed.payload
+        : {
+            ...claimed.payload,
+            allowedActionNames: persistedAllowedActionNames,
+        };
     return await runWithRequestContext({
         userEmail: claimed.ownerEmail ?? undefined,
         orgId: claimed.orgId ?? undefined,
+        run: persistedAllowedActionNames === undefined
+            ? undefined
+            : { allowedActionNames: persistedAllowedActionNames },
     }, async () => {
         const task = await loadTask(opts.taskId);
         if (!task) {
@@ -1184,13 +1202,18 @@ export async function processAgentTeamRun(opts) {
             await completeAgentTeamRun(opts.taskId, task.status === "completed" ? "done" : "failed");
             return { ok: true, skipped: "task-terminal" };
         }
-        const payload = claimed.payload;
         const ownerEmail = claimed.ownerEmail ?? getRequestUserEmail() ?? "";
         const orgId = claimed.orgId;
         const turnId = payload.turnId || taskRunId(opts.taskId);
         let config;
         try {
             config = await opts.resolveConfig({ payload, ownerEmail, orgId });
+            if (persistedAllowedActionNames !== undefined) {
+                config = {
+                    ...config,
+                    actions: filterActionsByAllowedNames(config.actions, persistedAllowedActionNames),
+                };
+            }
         }
         catch (err) {
             const message = err instanceof Error
@@ -1304,7 +1327,13 @@ export async function processAgentTeamRun(opts) {
                         task.currentStep = "";
                     }
                 };
-                await runWithRequestContext({ userEmail: ownerEmail || undefined, orgId: orgId ?? undefined }, 
+                await runWithRequestContext({
+                    userEmail: ownerEmail || undefined,
+                    orgId: orgId ?? undefined,
+                    run: persistedAllowedActionNames === undefined
+                        ? undefined
+                        : { allowedActionNames: persistedAllowedActionNames },
+                }, 
                 // Record THIS sub-agent's own delegation depth as the ambient
                 // depth for the duration of its agent loop. If a tool call from
                 // within the loop reaches `spawnTask` (even with the team tool not

package/dist/server/index.d.ts

@@ -13,7 +13,7 @@ export { requireEnvKey, type MissingKeyResponse } from "./missing-key.js";
 export { assertCurrentRequestUserIsOrgAdmin, currentRequestUserIsOrgAdmin, } from "./org-admin.js";
 export { verifyCaptcha, type CaptchaVerifyResult } from "./captcha.js";
 export { getLocaleInitScript, parseAcceptLanguage, resolveLocaleFromRequest, type LocaleInitScriptOptions, type ResolveLocaleFromRequestOptions, type ResolvedRequestLocale, } from "../localization/server.js";
-export { createProductionAgentHandler, type ActionEntry, type ScriptEntry, type ProductionAgentOptions, type ActionTool, type ScriptTool, type AgentMessage, type AgentChatRequest, type AgentChatEvent, type AgentChatAttachment, type AgentChatReference, type MentionProvider, type MentionProviderItem, type AgentLoopFinalResponseGuard, type AgentLoopFinalResponseGuardContext, type AgentLoopFinalResponseGuardResult, type AgentLoopToolCallSummary, type AgentLoopToolResultSummary, } from "../agent/index.js";
+export { createProductionAgentHandler, type ActionEntry, type ScriptEntry, type ProductionAgentOptions, type AgentActionSurface, type AgentActionSurfaceDetails, type ActionTool, type ScriptTool, type AgentMessage, type AgentChatRequest, type AgentChatEvent, type AgentChatAttachment, type AgentChatReference, type MentionProvider, type MentionProviderItem, type AgentLoopFinalResponseGuard, type AgentLoopFinalResponseGuardContext, type AgentLoopFinalResponseGuardResult, type AgentLoopToolCallSummary, type AgentLoopToolResultSummary, } from "../agent/index.js";
 export { actionsToEngineTools, executeAgentToolCall, getOwnerActiveApiKey, getOwnerApiKeyForEngine, resolveOwnerEngineApiKey, runAgentLoop, type AgentToolCallExecutionResult, type ExecuteAgentToolCallOptions, type ResolvedOwnerApiKey, } from "../agent/production-agent.js";
 export { mountRealtimeVoiceRoutes, realtimeVoiceSafetyIdentifier, REALTIME_VOICE_MAX_SDP_BYTES, REALTIME_VOICE_MAX_TOOL_BODY_BYTES, REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS, REALTIME_VOICE_SESSION_PATH, REALTIME_VOICE_TOOL_PATH, type MountRealtimeVoiceRoutesOptions, type RealtimeVoiceRequestContext, type RealtimeVoiceToolExecutionRequest, type RealtimeVoiceToolExecutionResult, } from "./realtime-voice.js";
 export { getStoredModelForEngine, resolveEngine, } from "../agent/engine/index.js";

package/dist/server/request-context.d.ts

@@ -59,6 +59,8 @@ export interface RequestRunContext {
     engine?: import("../agent/engine/types.js").AgentEngine;
     /** Model name for this run (set by onEngineResolved). */
     model?: string;
+    /** Request-authorized action names exposed to this agent run. */
+    allowedActionNames?: readonly string[];
     /**
      * True when this run is executing inside the durable background-function
      * worker (the `_process-run` self-dispatch), not the synchronous foreground
@@ -175,6 +177,11 @@ export interface RequestContext {
     run?: RequestRunContext;
 }
 type RequestContextObserver = (ctx: RequestContext) => void;
+/**
+ * Authorization state must never use the shared-stack compatibility fallback:
+ * overlapping async requests are only isolated by native AsyncLocalStorage.
+ */
+export declare function assertRequestActionSurfaceIsolation(): void;
 /**
  * Register a callback fired every time `runWithRequestContext` enters a new
  * scope. The hook runs INSIDE the AsyncLocalStorage scope, so observability