@agent-native/core 0.155.0 → 0.157.1

package/dist/server/agent-chat-plugin.js

@@ -12,7 +12,7 @@ import { AGENT_CHAT_BACKGROUND_RUN_FIELD, AGENT_CHAT_PROCESS_RUN_PATH, backgroun
 import { resolveEngine, createAnthropicEngine, getStoredModelForEngine, normalizeModelForEngine, resolveDelegatedRunModel, getAgentEngineEntry, isAgentEnginePackageInstalled, isStoredEngineUsableForRequest, listAgentEngines, registerBuiltinEngines, } from "../agent/engine/index.js";
 import { SYSTEM_PROMPT_CACHE_SPLIT } from "../agent/engine/prompt-cache.js";
 import { PROVIDER_TO_ENV } from "../agent/engine/provider-env-vars.js";
-import { createProductionAgentHandler, actionsToEngineTools, executeAgentToolCall, toolCallCacheKey, getActiveRunForThreadAsync, abortRunDurably, abortTurnDurably, subscribeToRun, } from "../agent/production-agent.js";
+import { createProductionAgentHandler, actionsToEngineTools, executeAgentToolCall, filterActionsByAllowedNames, readPersistedActionSurface, toolCallCacheKey, getActiveRunForThreadAsync, abortRunDurably, abortTurnDurably, subscribeToRun, } from "../agent/production-agent.js";
 import { callerHasRunAccess, callerHasThreadAccess, } from "../agent/run-ownership.js";
 import { markTurnAborted, readBackgroundRunClaim } from "../agent/run-store.js";
 import { buildCurrentTimeUserContext, buildRuntimeContextPrompt, } from "../agent/runtime-context.js";
@@ -208,6 +208,46 @@ export async function resolveA2ARecoverableArtifactSecret(orgId = getRequestOrgI
 export function buildLeanRunPolicyPrompt(codeEditingSurfaceRestriction, prodCodeExecPromptNote) {
     return codeEditingSurfaceRestriction + prodCodeExecPromptNote;
 }
+export function filterPromptActionsToSurface(actions, allowedActionNames) {
+    if (!allowedActionNames)
+        return actions;
+    return filterActionsByAllowedNames(actions, allowedActionNames.filter((name) => actions[name]));
+}
+/** Keep late-bound sandbox and data-program bridges on the current request's
+ * authorized registry instead of the plugin's process-wide action catalog. */
+export function filterRuntimeActionsToSurface(actions) {
+    return filterPromptActionsToSurface(actions, getRequestRunContext()?.allowedActionNames);
+}
+/** Remove framework guidance for tools that the request surface does not
+ * expose. The default framework prompt is line-oriented, so dropping the
+ * affected instruction keeps unrelated behavioral guidance intact without
+ * teaching the model names it cannot call. */
+export function filterFrameworkPromptToSurface(prompt, actions, allowedActionNames) {
+    if (!allowedActionNames)
+        return prompt;
+    const allowedNames = new Set(allowedActionNames);
+    const deniedPatterns = Object.keys(actions)
+        .filter((name) => !allowedNames.has(name))
+        .sort((a, b) => b.length - a.length)
+        .map((name) => {
+        const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        return new RegExp(`(^|[^a-z0-9-])${escaped}(?=$|[^a-z0-9-])`);
+    });
+    if (deniedPatterns.length === 0)
+        return prompt;
+    return prompt
+        .split("\n")
+        .filter((line) => !deniedPatterns.some((pattern) => pattern.test(line)))
+        .join("\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .trimEnd();
+}
+export function resolveProductionCodeExecutionForActionSurface(mode, hasRequestScopedSurface) {
+    // A trusted shell can reach action routes outside the native registry, so it
+    // cannot uphold a hard per-request allowlist. Keep sandboxed run-code, whose
+    // bridge is filtered against the current request, as the safe equivalent.
+    return hasRequestScopedSurface && mode === "trusted" ? "sandboxed" : mode;
+}
 /**
  * In-memory rate-limit tracker for `/generate-title`. Keyed by user email,
  * value is recent invocation timestamps within the rolling window. Stale
@@ -892,6 +932,11 @@ export function createAgentChatPlugin(options) {
                     : rawEnvCodeExec === "off"
                         ? "off"
                         : (options?.codeExecution?.production ?? "off");
+            const effectiveProdCodeExec = resolveProductionCodeExecutionForActionSurface(resolvedProdCodeExec, Boolean(options?.resolveActionSurface));
+            if (resolvedProdCodeExec === "trusted" &&
+                effectiveProdCodeExec !== "trusted") {
+                console.warn("[agent-native] Request-scoped action surfaces disable trusted shell tools; using sandboxed code execution instead.");
+            }
             // Forward-declaration for the production code-execution bridge supplier.
             // Must come before the code entries are created so their closures can capture it.
             let prodRunCodeToolActions = {};
@@ -902,11 +947,11 @@ export function createAgentChatPlugin(options) {
             const runCodeTool = await loadRunCodeToolEntries(
             // Supplier is evaluated at invocation time so runtime additions to
             // prodActions (e.g. MCP sync) are visible to the bridge.
-            () => prodRunCodeToolActions, { bridgeTools: options?.codeExecution?.bridgeTools });
+            () => filterRuntimeActionsToSurface(prodRunCodeToolActions), { bridgeTools: options?.codeExecution?.bridgeTools });
             const leanRunCodeTool = await loadRunCodeToolEntries(
             // Lean prompt mode intentionally exposes a much smaller action
             // surface; keep sandbox appAction() calls scoped to that same surface.
-            () => leanRunCodeToolActions, { bridgeTools: options?.codeExecution?.bridgeTools });
+            () => filterRuntimeActionsToSurface(leanRunCodeToolActions), { bridgeTools: options?.codeExecution?.bridgeTools });
             // Full coding tool registry (bash/read/edit/write) for "trusted" prod.
             // In dev mode this is handled separately via devHandler below.
             const prodCodingTools = {};
@@ -935,7 +980,7 @@ export function createAgentChatPlugin(options) {
             // use a late-binding supplier so devRunCodeTool can reference the
             // devActions registry once it is built below (see devHandler block).
             const devRunCodeTool = canToggle
-                ? await loadRunCodeToolEntries(() => devRunCodeToolActions, {
+                ? await loadRunCodeToolEntries(() => filterRuntimeActionsToSurface(devRunCodeToolActions), {
                     bridgeTools: options?.codeExecution?.bridgeTools,
                 })
                 : {};
@@ -946,7 +991,7 @@ export function createAgentChatPlugin(options) {
                 ...templateScripts,
                 ...(canToggle
                     ? devRunCodeTool
-                    : resolvedProdCodeExec !== "off"
+                    : effectiveProdCodeExec !== "off"
                         ? runCodeTool
                         : {}),
             };
@@ -1684,6 +1729,36 @@ export function createAgentChatPlugin(options) {
                 : "";
             const prodActionsPrompt = generateActionsPrompt(templateScripts, "tool", lazyContext ? effectiveInitialToolNames : undefined) + corpusToolsPrompt;
             const devActionsPrompt = generateActionsPrompt({ ...discoveredActions, ...templateScripts }, "cli") + corpusToolsPrompt;
+            const filterPromptActionsForRequest = (actions) => {
+                return filterPromptActionsToSurface(actions, getRequestRunContext()?.allowedActionNames);
+            };
+            const resolveRequestActionsPrompt = (mode) => {
+                const allowedNames = getRequestRunContext()?.allowedActionNames;
+                if (!allowedNames) {
+                    return mode === "tool" ? prodActionsPrompt : devActionsPrompt;
+                }
+                const promptActions = filterPromptActionsForRequest(mode === "tool"
+                    ? templateScripts
+                    : { ...discoveredActions, ...templateScripts });
+                const promptCorpus = filterPromptActionsForRequest(corpusPromptRegistry);
+                return (generateActionsPrompt(promptActions, mode) +
+                    (loadCorpusToolsInitially
+                        ? generateCorpusToolsPrompt(promptCorpus)
+                        : ""));
+            };
+            const leanActionsPrompt = prodActionsPrompt +
+                (a2aAgentDelegationEnabled
+                    ? generateActionsPrompt(callAgentScript, "tool")
+                    : "");
+            const resolveRequestLeanActionsPrompt = () => {
+                const allowedNames = getRequestRunContext()?.allowedActionNames;
+                if (!allowedNames)
+                    return leanActionsPrompt;
+                return generateActionsPrompt(filterPromptActionsForRequest({
+                    ...templateScripts,
+                    ...(a2aAgentDelegationEnabled ? callAgentScript : {}),
+                }), "tool");
+            };
             // Build system prompts — dynamic functions that pre-load resources per-request.
             // Production gets PROD_FRAMEWORK_PROMPT, dev gets DEV_FRAMEWORK_PROMPT.
             // Custom systemPrompt from options overrides the framework default entirely.
@@ -1695,10 +1770,19 @@ export function createAgentChatPlugin(options) {
             // `nativeActionsInDev` or `leanPrompt`), the dev prompt's "invoke
             // template actions via bash" guidance is wrong — use the prod prompt
             // + tool-format action list instead, same as production.
-            const devNative = options?.nativeActionsInDev === true || leanPrompt;
-            const devPrompt = devNative
-                ? prodPrompt
-                : (options?.devSystemPrompt
+            const devNative = options?.nativeActionsInDev === true ||
+                leanPrompt ||
+                Boolean(options?.resolveActionSurface);
+            // Keep legacy names for the composition below
+            const basePrompt = prodPrompt;
+            const getFrameworkPromptActions = () => Object.fromEntries(Object.entries(prodActions).filter(([name]) => !templateScripts[name] && !mcpActionEntries[name]));
+            const resolveRequestBasePrompt = () => (options?.systemPrompt ??
+                filterFrameworkPromptToSurface(lazyContext ? PROD_FRAMEWORK_PROMPT_COMPACT : PROD_FRAMEWORK_PROMPT, getFrameworkPromptActions(), getRequestRunContext()?.allowedActionNames)) + resolveRequestActionsPrompt("tool");
+            const resolveRequestLeanPrompt = () => (options?.systemPrompt ?? "") + resolveRequestLeanActionsPrompt();
+            const resolveRequestDevPrompt = () => {
+                if (devNative)
+                    return resolveRequestBasePrompt();
+                const frameworkPrompt = options?.devSystemPrompt
                     ? options.devSystemPrompt +
                         (options?.systemPrompt ??
                             (lazyContext
@@ -1706,9 +1790,9 @@ export function createAgentChatPlugin(options) {
                                 : PROD_FRAMEWORK_PROMPT))
                     : lazyContext
                         ? DEV_FRAMEWORK_PROMPT_COMPACT
-                        : DEV_FRAMEWORK_PROMPT) + devActionsPrompt;
-            // Keep legacy names for the composition below
-            const basePrompt = prodPrompt;
+                        : DEV_FRAMEWORK_PROMPT;
+                return frameworkPrompt + resolveRequestActionsPrompt("cli");
+            };
             if (mcpOptions.enabled) {
                 // Mount MCP remote server — same action registry as A2A + agent chat
                 const { mountMCP } = await import("../mcp/server.js");
@@ -2245,7 +2329,7 @@ export function createAgentChatPlugin(options) {
             const teamTools = createTeamTools({
                 getOwner: () => requireCurrentRunOwner("spawn or manage sub-agents"),
                 getSystemPrompt: () => getRequestRunContext()?.systemPrompt ?? basePrompt,
-                getActions: buildSubAgentActions,
+                getActions: () => filterRuntimeActionsToSurface(buildSubAgentActions()),
                 getEngine: () => {
                     const runCtx = getRequestRunContext();
                     // Sub-agents must inherit the parent run's resolved key so
@@ -2343,9 +2427,11 @@ export function createAgentChatPlugin(options) {
                 ...mcpActionEntries,
                 // Sandboxed run-code for hosted production when enabled, and for the
                 // app-rendered production-style handler in local dev.
-                ...(canToggle || resolvedProdCodeExec !== "off" ? runCodeTool : {}),
+                ...(canToggle || effectiveProdCodeExec !== "off" ? runCodeTool : {}),
                 // Full coding tools in production when mode is "trusted".
-                ...(!canToggle ? prodCodingTools : {}),
+                ...(!canToggle && effectiveProdCodeExec === "trusted"
+                    ? prodCodingTools
+                    : {}),
             });
             mountRealtimeVoiceRoutes(nitroApp, prodActions, {
                 resolveOrgId: options?.resolveOrgId,
@@ -2393,7 +2479,9 @@ export function createAgentChatPlugin(options) {
                 // Otherwise templates with a minimal prompt can advertise sandboxed
                 // execution in the system prompt while the actual tool registry omits
                 // it.
-                ...(canToggle || resolvedProdCodeExec !== "off" ? leanRunCodeTool : {}),
+                ...(canToggle || effectiveProdCodeExec !== "off"
+                    ? leanRunCodeTool
+                    : {}),
             });
             leanRunCodeToolActions = leanActions;
             // Keep the prod action dict's MCP entries in sync when the manager's
@@ -2410,14 +2498,18 @@ export function createAgentChatPlugin(options) {
             // Lean mode: use only the template's systemPrompt + actions list.
             // Skip resource loading and schema block — those add DB round-trips
             // and tokens that minimal/voice apps don't need.
-            const leanActionsPrompt = prodActionsPrompt +
-                (a2aAgentDelegationEnabled
-                    ? generateActionsPrompt(callAgentScript, "tool")
-                    : "");
-            const leanBasePrompt = (options?.systemPrompt ?? "") + leanActionsPrompt;
             const anonymousReadOnlyPrompt = (options?.systemPrompt ?? PROD_FRAMEWORK_PROMPT_COMPACT) +
                 generateActionsPrompt(filterReadOnlyActions(templateScripts), "tool", lazyContext ? effectiveInitialToolNames : undefined) +
                 "\n\nYou are answering from a public shared page. Treat the visible resource as read-only: do not create, edit, delete, comment on, share, or otherwise mutate app data. If the user asks for a change, describe what you would change or suggest signing in to edit.";
+            const resolveAnonymousReadOnlyPrompt = () => {
+                if (!getRequestRunContext()?.allowedActionNames) {
+                    return anonymousReadOnlyPrompt;
+                }
+                return ((options?.systemPrompt ??
+                    filterFrameworkPromptToSurface(PROD_FRAMEWORK_PROMPT_COMPACT, getFrameworkPromptActions(), getRequestRunContext()?.allowedActionNames)) +
+                    generateActionsPrompt(filterPromptActionsForRequest(filterReadOnlyActions(templateScripts)), "tool") +
+                    "\n\nYou are answering from a public shared page. Treat the visible resource as read-only: do not create, edit, delete, comment on, share, or otherwise mutate app data. If the user asks for a change, describe what you would change or suggest signing in to edit.");
+            };
             // Per-request preamble shared by both prod and dev handlers. Resolves
             // owner + user API key onto the AsyncLocalStorage run context so
             // downstream tool closures (automation, fetch, team) read the
@@ -2585,8 +2677,8 @@ When the user asks to add a feature, edit a component, fix a bug in the app itse
 Non-code requests are still fine on this surface: read data, navigate the UI, summarize, search, create/update extensions (sandboxed Alpine.js mini-apps stored in SQL), and call template actions. The restriction is specifically about direct edits to the host app's own source files.
 </app-rendered-chat-no-direct-code-edits>`;
             // System-prompt note appended when production code execution is enabled.
-            const prodCodeExecPromptNote = !canToggle && resolvedProdCodeExec !== "off"
-                ? resolvedProdCodeExec === "trusted"
+            const prodCodeExecPromptNote = !canToggle && effectiveProdCodeExec !== "off"
+                ? effectiveProdCodeExec === "trusted"
                     ? "\n\n<code-execution-mode>Full shell access is enabled (trusted mode). You have bash, read, edit, write, and run-code tools available. Use bash for file discovery, running tests and builds, and project CLIs. Use run-code for sandboxed JavaScript data processing: provider/API pagination, joins, classification, aggregation, and large-response reduction. Use tool-orchestration for short bounded fan-out or reduction over read-only tools. Use `pnpm action <name>` in bash to invoke registered app actions from the shell.</code-execution-mode>"
                     : "\n\n<code-execution-mode>Sandboxed code execution is enabled. Use tool-orchestration for short bounded fan-out, joins, and reduction over read-only tools. Use run-code when you need its broader provider/web helpers, workspace staging, or durable background execution. In either tool, authenticated calls go through the provided host globals and results should be reduced before printing.</code-execution-mode>"
                 : "";
@@ -2594,6 +2686,10 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 actions: leanPrompt ? leanActions : prodActions,
                 systemPrompt: async (event) => {
                     const { owner, extra } = await prepareRun(event);
+                    const requestActionsPrompt = resolveRequestActionsPrompt("tool");
+                    const requestLeanActionsPrompt = resolveRequestLeanActionsPrompt();
+                    const requestBasePrompt = resolveRequestBasePrompt();
+                    const requestLeanPrompt = resolveRequestLeanPrompt();
                     const runtimeContext = runtimeContextForEvent(event);
                     const codeEditingSurfaceRestriction = shouldBlockInProductCodeEditing(event)
                         ? APP_RENDERED_CHAT_NO_DIRECT_CODE_PROMPT
@@ -2612,8 +2708,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         const leanRunPolicyPrompt = buildLeanRunPolicyPrompt(codeEditingSurfaceRestriction, prodCodeExecPromptNote);
                         const resources = await loadResourcesForPrompt(owner, true, options?.appId, undefined, { disabledFrameworkGroups });
                         await emitContextXraySystemSections(event, {
-                            frameworkPrompt: leanBasePrompt.slice(0, Math.max(0, leanBasePrompt.length - leanActionsPrompt.length)),
-                            actionsPrompt: leanActionsPrompt,
+                            frameworkPrompt: requestLeanPrompt.slice(0, Math.max(0, requestLeanPrompt.length - requestLeanActionsPrompt.length)),
+                            actionsPrompt: requestLeanActionsPrompt,
                             additionalFramework: leanRunPolicyPrompt,
                             resources,
                             extra,
@@ -2621,7 +2717,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             runtimeContext,
                         });
                         return setSystemPromptOnContext(buildLeanSystemPrompt({
-                            basePrompt: leanBasePrompt,
+                            basePrompt: requestLeanPrompt,
                             additionalFramework: leanRunPolicyPrompt,
                             cacheSplit: SYSTEM_PROMPT_CACHE_SPLIT,
                             resources,
@@ -2637,8 +2733,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         ? ""
                         : await buildSchemaBlock(owner, databaseToolsMode);
                     await emitContextXraySystemSections(event, {
-                        frameworkPrompt: basePrompt.slice(0, Math.max(0, basePrompt.length - prodActionsPrompt.length)),
-                        actionsPrompt: prodActionsPrompt,
+                        frameworkPrompt: requestBasePrompt.slice(0, Math.max(0, requestBasePrompt.length - requestActionsPrompt.length)),
+                        actionsPrompt: requestActionsPrompt,
                         resources,
                         schemaBlock,
                         extra,
@@ -2646,7 +2742,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         runtimeContext,
                         additionalFramework: codeEditingSurfaceRestriction + prodCodeExecPromptNote,
                     });
-                    return setSystemPromptOnContext(basePrompt +
+                    return setSystemPromptOnContext(requestBasePrompt +
                         SYSTEM_PROMPT_CACHE_SPLIT +
                         resources +
                         schemaBlock +
@@ -2708,6 +2804,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         message,
                     };
                 },
+                resolveActionSurface: options?.resolveActionSurface,
                 skipFilesContext,
                 initialToolNames: effectiveInitialToolNames,
                 ...(options?.toolLimits ? { toolLimits: options.toolLimits } : {}),
@@ -2741,12 +2838,13 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     actions: anonymousReadOnlyActions,
                     systemPrompt: async (event) => {
                         const { extra } = await prepareRun(event);
+                        const requestAnonymousPrompt = resolveAnonymousReadOnlyPrompt();
                         await emitContextXraySystemSections(event, {
-                            frameworkPrompt: anonymousReadOnlyPrompt,
+                            frameworkPrompt: requestAnonymousPrompt,
                             extra,
                             runtimeContext: runtimeContextForEvent(event),
                         });
-                        return setSystemPromptOnContext(anonymousReadOnlyPrompt +
+                        return setSystemPromptOnContext(requestAnonymousPrompt +
                             extra +
                             runtimeContextForEvent(event));
                     },
@@ -2756,6 +2854,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     ...resolveInteractiveAgentRunOptions(options),
                     finalResponseGuard: options?.finalResponseGuard,
                     prepareRequest: options?.prepareRequest,
+                    resolveActionSurface: options?.resolveActionSurface,
                     skipFilesContext: true,
                     initialToolNames: effectiveInitialToolNames,
                     onEngineResolved: (engine, model) => {
@@ -2847,6 +2946,10 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     actions: devActions,
                     systemPrompt: async (event) => {
                         const { owner, extra } = await prepareRun(event);
+                        const requestActionsPrompt = resolveRequestActionsPrompt(devNative ? "tool" : "cli");
+                        const requestLeanActionsPrompt = resolveRequestLeanActionsPrompt();
+                        const requestLeanPrompt = resolveRequestLeanPrompt();
+                        const requestDevPrompt = resolveRequestDevPrompt();
                         const runtimeContext = runtimeContextForEvent(event);
                         const modelOverlay = resolveModelOverlay();
                         // Stable-first ordering: runtimeContext (day-granular) is
@@ -2856,15 +2959,15 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         if (leanPrompt) {
                             const resources = await loadResourcesForPrompt(owner, true, options?.appId, undefined, { disabledFrameworkGroups });
                             await emitContextXraySystemSections(event, {
-                                frameworkPrompt: leanBasePrompt.slice(0, Math.max(0, leanBasePrompt.length - leanActionsPrompt.length)),
-                                actionsPrompt: leanActionsPrompt,
+                                frameworkPrompt: requestLeanPrompt.slice(0, Math.max(0, requestLeanPrompt.length - requestLeanActionsPrompt.length)),
+                                actionsPrompt: requestLeanActionsPrompt,
                                 resources,
                                 extra,
                                 modelOverlay,
                                 runtimeContext,
                             });
                             return setSystemPromptOnContext(buildLeanSystemPrompt({
-                                basePrompt: leanBasePrompt,
+                                basePrompt: requestLeanPrompt,
                                 resources,
                                 extra,
                                 modelOverlay,
@@ -2876,17 +2979,15 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             ? ""
                             : await buildSchemaBlock(owner, databaseToolsMode);
                         await emitContextXraySystemSections(event, {
-                            frameworkPrompt: devNative
-                                ? basePrompt.slice(0, Math.max(0, basePrompt.length - prodActionsPrompt.length))
-                                : devPrompt.slice(0, Math.max(0, devPrompt.length - devActionsPrompt.length)),
-                            actionsPrompt: devNative ? prodActionsPrompt : devActionsPrompt,
+                            frameworkPrompt: requestDevPrompt.slice(0, Math.max(0, requestDevPrompt.length - requestActionsPrompt.length)),
+                            actionsPrompt: requestActionsPrompt,
                             resources,
                             schemaBlock,
                             extra,
                             modelOverlay,
                             runtimeContext,
                         });
-                        return setSystemPromptOnContext(devPrompt +
+                        return setSystemPromptOnContext(requestDevPrompt +
                             resources +
                             schemaBlock +
                             extra +
@@ -2913,6 +3014,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         }
                         return options?.prepareRequest?.(details);
                     },
+                    resolveActionSurface: options?.resolveActionSurface,
                     skipFilesContext,
                     initialToolNames: effectiveInitialToolNames,
                     ...(options?.toolLimits ? { toolLimits: options.toolLimits } : {}),
@@ -3085,7 +3187,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             // just told, and filtering to the full set would only add a
                             // tool-search schema with nothing new for it to find.
                             return {
-                                baseSystemPrompt: basePrompt,
+                                baseSystemPrompt: filterFrameworkPromptToSurface(basePrompt, prodActions, payload.allowedActionNames),
                                 actions: buildSubAgentActions(),
                                 engine,
                                 model,
@@ -4793,7 +4895,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     // helper expands that owner into the same user/org AsyncLocalStorage
                     // context the foreground request uses, so credential and data scoping
                     // stay aligned.
-                    await seedBackgroundAgentRunOwnerContext(event, prepared.runId);
+                    const persistedSurface = readPersistedActionSurface(workerBody, "__resolvedActionSurface");
+                    await seedBackgroundAgentRunOwnerContext(event, prepared.runId, persistedSurface?.orgId);
                     return await invokeAgentChatHandler(event);
                 }
                 catch (err) {

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-run-context.d.ts

@@ -4,6 +4,12 @@ export type AgentRunOwnerContext = {
     owner: string;
     anonymous: boolean;
     name?: string;
+    /**
+     * Trusted org binding for a cookieless durable worker. Presence matters:
+     * `null` means the authenticated foreground request had no org and must not
+     * fall back to another membership during worker re-entry.
+     */
+    orgId?: string | null;
 };
 export declare const AGENT_RUN_OWNER_CONTEXT_KEY = "__agentNativeOwnerContext";
 type AnonymousOwnerResolver = (event: H3Event) => string | null | Promise<string | null>;
@@ -20,7 +26,7 @@ export declare function readAgentRunTimezone(event: H3Event): string | undefined
  */
 export declare function readBrowserSessionIdHeader(event: H3Event): string | undefined;
 export declare function seedAgentRunOwnerContext(event: H3Event, ownerContext: AgentRunOwnerContext): AgentRunOwnerContext;
-export declare function seedBackgroundAgentRunOwnerContext(event: H3Event, runId: string): Promise<AgentRunOwnerContext | null>;
+export declare function seedBackgroundAgentRunOwnerContext(event: H3Event, runId: string, orgId?: string | null): Promise<AgentRunOwnerContext | null>;
 export declare function resolveAgentRunOwnerContext(event: H3Event, options?: {
     anonymousOwner?: AnonymousOwnerResolver;
 }): Promise<AgentRunOwnerContext>;

package/dist/server/agent-run-context.js

@@ -67,13 +67,17 @@ export function seedAgentRunOwnerContext(event, ownerContext) {
         ownerContext;
     return ownerContext;
 }
-export async function seedBackgroundAgentRunOwnerContext(event, runId) {
+export async function seedBackgroundAgentRunOwnerContext(event, runId, orgId) {
     try {
         const { getRunOwnerEmail } = await import("../agent/run-store.js");
         const owner = await getRunOwnerEmail(runId);
         if (!owner)
             return null;
-        return seedAgentRunOwnerContext(event, { owner, anonymous: false });
+        return seedAgentRunOwnerContext(event, {
+            owner,
+            anonymous: false,
+            ...(orgId !== undefined ? { orgId } : {}),
+        });
     }
     catch {
         return null;
@@ -105,6 +109,9 @@ export async function resolveAgentRunOwnerContext(event, options = {}) {
     });
 }
 export async function resolveAgentRunOrgId(options) {
+    if (Object.prototype.hasOwnProperty.call(options.ownerContext, "orgId")) {
+        return normalizeId(options.ownerContext.orgId);
+    }
     let resolvedOrgId;
     if (options.resolveOrgId) {
         resolvedOrgId = normalizeId(await options.resolveOrgId(options.event));

package/dist/server/agent-teams-run-queue.d.ts

@@ -31,6 +31,9 @@ export interface AgentTeamRunPayload {
     parentRunId?: string;
     /** Display name for the sub-agent tab. */
     name?: string;
+    /** Exact action registry captured when the parent spawned this task. Older
+     * queue rows omit it and retain their original unscoped behavior. */
+    allowedActionNames?: string[];
     /** Logical-turn id, stable across continuation chunks so durable assistant
      * messages fold into one. */
     turnId: string;

package/dist/server/agent-teams.js

@@ -17,7 +17,7 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { applyAgentTextEventToBuffer } from "../a2a/response-text.js";
 import { resolveMainChatMaxOutputTokens } from "../agent/engine/output-tokens.js";
-import { actionsToEngineTools, filterInitialEngineTools, resolveAgentRequestReasoningEffort, } from "../agent/production-agent.js";
+import { actionsToEngineTools, filterActionsByAllowedNames, filterInitialEngineTools, readPersistedAllowedActionNames, resolveAgentRequestReasoningEffort, } from "../agent/production-agent.js";
 import { runAgentLoop, appendAgentLoopContinuation, } from "../agent/production-agent.js";
 import { abortRun, getActiveRunForThreadAsync, getRun, startRun, subscribeToRun, } from "../agent/run-manager.js";
 import { getRunEventsSince } from "../agent/run-store.js";
@@ -31,7 +31,7 @@ import { describeDbError } from "../db/client.js";
 import { resolveOrgIdForEmail } from "../org/context.js";
 import { completeRun as completeProgressRun, startRun as startProgressRun, updateRunProgress, } from "../progress/registry.js";
 import { enqueueAgentTeamRun, claimAgentTeamRun, touchAgentTeamRun, bumpAgentTeamContinuation, completeAgentTeamRun, getAgentTeamRunDispatchState, listActiveAgentTeamTaskIdsForOwner, MAX_AGENT_TEAM_CONTINUATIONS, MAX_AGENT_TEAM_NO_PROGRESS_CONTINUATIONS, RUN_DISPATCH_STUCK_AFTER_MS, RUN_PROCESSING_STUCK_AFTER_MS, } from "./agent-teams-run-queue.js";
-import { getRequestUserEmail, runWithRequestContext, } from "./request-context.js";
+import { getRequestOrgId, getRequestRunContext, getRequestUserEmail, hasRequestContext, runWithRequestContext, } from "./request-context.js";
 import { fireInternalDispatch } from "./self-dispatch.js";
 /**
  * Ambient delegation depth for the agent whose run is currently executing.
@@ -972,12 +972,17 @@ export async function spawnTask(opts) {
     // (integrations/webhook-handler.ts). Execution happens in `processAgentTeamRun`,
     // invoked by the `/_agent-native/agent-teams/_process-run` route mounted
     // inside the agent-chat plugin (where the action/prompt/engine closures live).
-    let orgId = null;
-    try {
-        orgId = (await resolveOrgIdForEmail(opts.ownerEmail)) ?? null;
+    let orgId;
+    if (hasRequestContext()) {
+        orgId = getRequestOrgId() ?? null;
     }
-    catch {
-        orgId = null;
+    else {
+        try {
+            orgId = await resolveOrgIdForEmail(opts.ownerEmail);
+        }
+        catch {
+            orgId = null;
+        }
     }
     const payload = {
         description: opts.description,
@@ -986,6 +991,9 @@ export async function spawnTask(opts) {
         ...(opts.parentThreadId ? { parentThreadId: opts.parentThreadId } : {}),
         ...(opts.parentRunId ? { parentRunId: opts.parentRunId } : {}),
         ...(opts.name ? { name: opts.name } : {}),
+        ...(getRequestRunContext()?.allowedActionNames !== undefined
+            ? { allowedActionNames: Object.keys(opts.actions) }
+            : {}),
         // Stable across continuation chunks so the durable assistant message folds.
         turnId: runId,
     };
@@ -1171,9 +1179,19 @@ export async function processAgentTeamRun(opts) {
     const claimed = await claimAgentTeamRun(opts.taskId);
     if (!claimed)
         return { ok: true, skipped: "already-claimed-or-missing" };
+    const persistedAllowedActionNames = readPersistedAllowedActionNames(claimed.payload);
+    const payload = persistedAllowedActionNames === undefined
+        ? claimed.payload
+        : {
+            ...claimed.payload,
+            allowedActionNames: persistedAllowedActionNames,
+        };
     return await runWithRequestContext({
         userEmail: claimed.ownerEmail ?? undefined,
         orgId: claimed.orgId ?? undefined,
+        run: persistedAllowedActionNames === undefined
+            ? undefined
+            : { allowedActionNames: persistedAllowedActionNames },
     }, async () => {
         const task = await loadTask(opts.taskId);
         if (!task) {
@@ -1184,13 +1202,18 @@ export async function processAgentTeamRun(opts) {
             await completeAgentTeamRun(opts.taskId, task.status === "completed" ? "done" : "failed");
             return { ok: true, skipped: "task-terminal" };
         }
-        const payload = claimed.payload;
         const ownerEmail = claimed.ownerEmail ?? getRequestUserEmail() ?? "";
         const orgId = claimed.orgId;
         const turnId = payload.turnId || taskRunId(opts.taskId);
         let config;
         try {
             config = await opts.resolveConfig({ payload, ownerEmail, orgId });
+            if (persistedAllowedActionNames !== undefined) {
+                config = {
+                    ...config,
+                    actions: filterActionsByAllowedNames(config.actions, persistedAllowedActionNames),
+                };
+            }
         }
         catch (err) {
             const message = err instanceof Error
@@ -1304,7 +1327,13 @@ export async function processAgentTeamRun(opts) {
                         task.currentStep = "";
                     }
                 };
-                await runWithRequestContext({ userEmail: ownerEmail || undefined, orgId: orgId ?? undefined }, 
+                await runWithRequestContext({
+                    userEmail: ownerEmail || undefined,
+                    orgId: orgId ?? undefined,
+                    run: persistedAllowedActionNames === undefined
+                        ? undefined
+                        : { allowedActionNames: persistedAllowedActionNames },
+                }, 
                 // Record THIS sub-agent's own delegation depth as the ambient
                 // depth for the duration of its agent loop. If a tool call from
                 // within the loop reaches `spawnTask` (even with the team tool not

package/dist/server/auth-marketing.d.ts

@@ -3,6 +3,7 @@ export interface AuthMarketingContent {
     tagline: string;
     description?: string;
     features?: string[];
+    /** @deprecated Local execution is no longer offered from auth pages. */
     runLocalCommand?: string;
     signupLocalModeNote?: {
         text: string;

package/dist/server/auth-marketing.js

@@ -53,7 +53,6 @@ export const BUILT_IN_AUTH_MARKETING = {
             "Review PR recaps with diagrams, file maps, and annotated code",
             "Share links for async comments and product review",
         ],
-        runLocalCommand: PLAN_LOCAL_FILES_COMMAND,
         signupLocalModeNote: {
             text: "Prefer no account or self-hosting? Switch /visual-plan to local files only:",
             command: PLAN_LOCAL_FILES_COMMAND,
@@ -103,7 +102,6 @@ export const BUILT_IN_AUTH_MARKETING = {
             "Multi-account Gmail in a single unified inbox",
             "Autonomous triage, archiving, and follow-ups",
         ],
-        runLocalCommand: "npx @agent-native/core@latest create my-mail-app --template mail",
     },
     slides: {
         appName: "Agent-Native Slides",

package/dist/server/auth.d.ts

@@ -110,6 +110,7 @@ export interface AuthOptions {
         tagline: string;
         description?: string;
         features?: string[];
+        /** @deprecated Local execution is no longer offered from auth pages. */
         runLocalCommand?: string;
     };
     /**

package/dist/server/auth.js

@@ -3309,6 +3309,24 @@ async function mountBetterAuthRoutes(app, options) {
     }));
     // Passwordless login via Better Auth's rate-limited magic-link plugin.
     app.use("/_agent-native/auth/magic-link", defineEventHandler(async (event) => {
+        if (getMethod(event) === "GET") {
+            const query = getQuery(event);
+            if (typeof query.token === "string") {
+                const verificationUrl = new URL(`${getAppBasePath()}/_agent-native/auth/ba/magic-link/verify`, getOrigin(event));
+                for (const key of [
+                    "token",
+                    "callbackURL",
+                    "newUserCallbackURL",
+                    "errorCallbackURL",
+                ]) {
+                    const value = query[key];
+                    if (typeof value === "string") {
+                        verificationUrl.searchParams.set(key, value);
+                    }
+                }
+                return redirectWithStagedCookies(event, verificationUrl.toString());
+            }
+        }
         if (getMethod(event) !== "POST") {
             setResponseStatus(event, 405);
             return { error: "Method not allowed" };