@agent-native/core 0.157.9 → 0.157.10

package/dist/integrations/index.d.ts

@@ -6,15 +6,15 @@ export { resolveDefaultIntegrationExecutionContext } from "./identity.js";
 export { upsertVerifiedIntegrationIdentity, type IntegrationIdentityLink, } from "./identity-links-store.js";
 export { BUILT_IN_INTEGRATION_CATALOG, INTEGRATION_CATEGORIES, getIntegrationCatalogEntry, listBuiltInChannelIntegrations, listIntegrationCatalog, type BuiltInChannelId, type AutomationCapabilities, type ChannelCapabilities, type IntegrationAvailability, type IntegrationCatalogEntry, type IntegrationCategory, type IntegrationCredentialRequirement, type IntegrationIconKey, type IntegrationSupportMaturity, } from "./catalog.js";
 export { BUILT_IN_INTEGRATION_ADAPTER_FACTORIES, BUILT_IN_INTEGRATION_ADAPTER_IDS, createBuiltInIntegrationAdapters, createIntegrationsPlugin, defaultIntegrationsPlugin, enqueueRemoteCommand, } from "./plugin.js";
-export { createRemoteDevice, getRemoteComputerCapabilities, listRemoteDevicesForOwner, revokeRemoteDeviceForOwner, unregisterRemoteDevice, } from "./remote-devices-store.js";
-export { claimNextComputerCommand, enqueueComputerCommand, getRemoteCommand, listRemoteCommandsForOwner, } from "./remote-commands-store.js";
+export { createRemoteDevice, getRemoteComputerCapabilities, getRemoteExecutionCapabilities, listRemoteDevicesForOwner, revokeRemoteDeviceForOwner, unregisterRemoteDevice, } from "./remote-devices-store.js";
+export { claimNextComputerCommand, enqueueComputerCommand, getRemoteCommand, getRemoteCommandByIdempotencyKey, listRemoteCommandsForOwner, } from "./remote-commands-store.js";
 export { createRemoteBrowserActionEntries, type CreateRemoteBrowserActionEntriesOptions, } from "./remote-browser-actions.js";
 export { assertValidComputerCommandEnvelope, computeComputerActionHash, computerOperationRequiresApproval, ComputerSupervisionError, } from "./computer-supervision.js";
 export { authorizeComputerOperation, createComputerApprovalRequest, decideComputerApproval, getComputerApprovalForOwner, listComputerApprovalsForOwner, type ComputerApprovalRecord, type ComputerApprovalStatus, } from "./computer-supervision-store.js";
 export { insertRemoteLiveViewEvents } from "./remote-run-events-store.js";
 export { listRemotePushNotificationsForOwner, listRemotePushRegistrationsForOwner, queueRemotePushNotifications, toPublicRemotePushRegistration, unregisterRemotePushRegistrationForOwner, upsertRemotePushRegistration, } from "./remote-push-store.js";
 export { deliverPendingRemotePushNotifications } from "./remote-push-delivery.js";
-export type { ComputerApprovalScope, ComputerCommandAction, ComputerCommandEnvelope, ComputerOperationClass, PublicRemotePushRegistration, PublicRemoteDevice, RemoteComputerCapabilities, RemoteCommand, RemoteDevice, RemoteDeviceMetadata, RemoteLiveViewEvent, RemotePushNotification, RemotePushRegistration, RemoteRunEvent, } from "./remote-types.js";
+export type { ComputerApprovalScope, ComputerCommandAction, ComputerCommandEnvelope, ComputerOperationClass, PublicRemotePushRegistration, PublicRemoteDevice, RemoteComputerCapabilities, RemoteExecutionCapabilities, RemoteExecutionBackend, RemoteExecutionPersistence, RemoteExecutionWorkload, RemoteCommand, RemoteDevice, RemoteDeviceMetadata, RemoteLiveViewEvent, RemotePushNotification, RemotePushRegistration, RemoteRunEvent, } from "./remote-types.js";
 export { resolveSlackBotTokenForIncoming, slackAdapter, type SlackAdapterOptions, } from "./adapters/slack.js";
 export { telegramAdapter } from "./adapters/telegram.js";
 export { whatsappAdapter } from "./adapters/whatsapp.js";

package/dist/integrations/index.js

@@ -6,8 +6,8 @@ export { upsertVerifiedIntegrationIdentity, } from "./identity-links-store.js";
 export { BUILT_IN_INTEGRATION_CATALOG, INTEGRATION_CATEGORIES, getIntegrationCatalogEntry, listBuiltInChannelIntegrations, listIntegrationCatalog, } from "./catalog.js";
 // Plugin
 export { BUILT_IN_INTEGRATION_ADAPTER_FACTORIES, BUILT_IN_INTEGRATION_ADAPTER_IDS, createBuiltInIntegrationAdapters, createIntegrationsPlugin, defaultIntegrationsPlugin, enqueueRemoteCommand, } from "./plugin.js";
-export { createRemoteDevice, getRemoteComputerCapabilities, listRemoteDevicesForOwner, revokeRemoteDeviceForOwner, unregisterRemoteDevice, } from "./remote-devices-store.js";
-export { claimNextComputerCommand, enqueueComputerCommand, getRemoteCommand, listRemoteCommandsForOwner, } from "./remote-commands-store.js";
+export { createRemoteDevice, getRemoteComputerCapabilities, getRemoteExecutionCapabilities, listRemoteDevicesForOwner, revokeRemoteDeviceForOwner, unregisterRemoteDevice, } from "./remote-devices-store.js";
+export { claimNextComputerCommand, enqueueComputerCommand, getRemoteCommand, getRemoteCommandByIdempotencyKey, listRemoteCommandsForOwner, } from "./remote-commands-store.js";
 export { createRemoteBrowserActionEntries, } from "./remote-browser-actions.js";
 export { assertValidComputerCommandEnvelope, computeComputerActionHash, computerOperationRequiresApproval, ComputerSupervisionError, } from "./computer-supervision.js";
 export { authorizeComputerOperation, createComputerApprovalRequest, decideComputerApproval, getComputerApprovalForOwner, listComputerApprovalsForOwner, } from "./computer-supervision-store.js";

package/dist/integrations/plugin.js

@@ -40,7 +40,7 @@ import { extractBearerToken, verifyInternalToken } from "./internal-token.js";
 import { retryStuckPendingTasks, startPendingTasksRetryJob, } from "./pending-tasks-retry-job.js";
 import { claimPendingTask, getNextPendingTaskForThread, getPendingTask, insertPendingTask, isDuplicateEventError, MAX_PENDING_TASK_ATTEMPTS, markTaskCompleted, markTaskDeliveryRetryable, markTaskFailed, markTaskRetryable, stageTaskDeliveryPayload, } from "./pending-tasks-store.js";
 import { claimNextComputerCommand, claimNextRemoteCommand, enqueueComputerCommand, enqueueRemoteCommand as enqueueRemoteCommandRow, isRemoteCommandKind, listRemoteCommandsForOwner, updateRemoteCommandResult, } from "./remote-commands-store.js";
-import { authenticateRemoteDeviceToken, createRemoteDevice, getRemoteComputerCapabilities, getRemoteDeviceForOwner, listRemoteDevicesForOwner, revokeRemoteDeviceForOwner, toPublicRemoteDevice, unregisterRemoteDevice, updateRemoteDeviceDetails, } from "./remote-devices-store.js";
+import { authenticateRemoteDeviceToken, createRemoteDevice, getRemoteComputerCapabilities, getRemoteExecutionCapabilities, getRemoteDeviceForOwner, listRemoteDevicesForOwner, revokeRemoteDeviceForOwner, toPublicRemoteDevice, unregisterRemoteDevice, updateRemoteDeviceDetails, } from "./remote-devices-store.js";
 import { startRemotePushDeliveryJob } from "./remote-push-delivery-job.js";
 import { listRemotePushNotificationsForOwner, listRemotePushRegistrationsForOwner, queueRemotePushNotifications, toPublicRemotePushRegistration, unregisterRemotePushRegistrationForOwner, upsertRemotePushRegistration, } from "./remote-push-store.js";
 import { startRemoteCommandsRetryJob } from "./remote-retry-job.js";
@@ -290,9 +290,17 @@ export async function enqueueRemoteCommand(envelope) {
         limit: 10,
     });
     const requestedDeviceId = readString(command.hostId) ?? readString(command.deviceId);
-    const device = (requestedDeviceId
+    const device = requestedDeviceId
         ? devices.find((candidate) => candidate.id === requestedDeviceId)
-        : undefined) ?? devices[0];
+        : devices[0];
+    if (requestedDeviceId && !device) {
+        return {
+            ok: false,
+            hostOnline: false,
+            hostStatus: "offline",
+            error: "The requested execution host is not paired with this account.",
+        };
+    }
     if (!device) {
         return {
             ok: false,
@@ -353,6 +361,13 @@ function remoteCodeCommandParams(command) {
             cwd: readString(command.cwd),
             goalId: readString(command.goalId) ?? "task",
             permissionMode: readString(command.permissionMode),
+            engine: readString(command.engine),
+            model: readString(command.model),
+            effort: readString(command.effort),
+            reasoningEffort: readString(command.reasoningEffort),
+            runId: readString(command.runId),
+            workload: readString(command.workload) ?? "code-agent",
+            metadata: readObject(command.metadata) ?? undefined,
         };
     }
     if (type === "continue") {
@@ -389,6 +404,13 @@ function enqueueBodyToRemoteCodeCommand(body) {
             cwd: payload.cwd,
             goalId: payload.goalId,
             permissionMode: payload.permissionMode,
+            engine: payload.engine,
+            model: payload.model,
+            effort: payload.effort,
+            reasoningEffort: payload.reasoningEffort,
+            runId: payload.runId,
+            workload: payload.workload,
+            metadata: payload.metadata,
         };
     }
     if (operation === "code-agent.run.follow-up") {
@@ -473,6 +495,14 @@ async function hasOnlineRemoteDevice(ownerEmail, orgId) {
 }
 function remoteDeviceToHost(device) {
     const online = device.status === "active" && isRemoteDeviceOnline(device);
+    const executionCapabilities = getRemoteExecutionCapabilities(device);
+    const capabilities = [
+        ...(executionCapabilities?.workloads ?? []).map((workload) => `workload:${workload}`),
+        ...(executionCapabilities?.engines ?? []).map((engine) => `engine:${engine}`),
+        ...(executionCapabilities?.acceptsScheduledWork ? ["scheduled-task"] : []),
+        ...(executionCapabilities?.acceptsPortalHandoffs ? ["portal"] : []),
+        ...(device.metadata?.computerCapabilities ? ["computer"] : []),
+    ];
     return {
         id: device.id,
         name: device.label,
@@ -484,6 +514,8 @@ function remoteDeviceToHost(device) {
         platform: device.platform ?? "desktop",
         appVersion: device.appVersion ?? undefined,
         hostName: device.hostName ?? undefined,
+        capabilities,
+        executionCapabilities: executionCapabilities ?? undefined,
         metadata: device.metadata ?? undefined,
         device: toPublicRemoteDevice(device),
     };
@@ -672,7 +704,13 @@ export function createIntegrationsPlugin(options) {
             return runWithRequestContext(context, fn);
         }
         async function requireRemoteDevice(event) {
-            const token = extractBearerToken(getRequestHeader(event, "authorization"));
+            // Some managed proxies omit Authorization before a serverless function
+            // sees the request. Keep the device secret in a dedicated TLS-only
+            // header as a transport fallback; the value is still hashed and looked
+            // up by authenticateRemoteDeviceToken, never persisted raw.
+            const token = extractBearerToken(getRequestHeader(event, "authorization")) ??
+                (getRequestHeader(event, "x-agent-native-device-token")?.trim() ||
+                    null);
             const device = await authenticateRemoteDeviceToken(token);
             if (device)
                 return device;
@@ -785,6 +823,8 @@ export function createIntegrationsPlugin(options) {
             const label = typeof body.label === "string" && body.label.trim()
                 ? body.label.trim().slice(0, 200)
                 : "Remote device";
+            const metadata = readObject(body.metadata);
+            const hasExecutionCapabilities = Object.prototype.hasOwnProperty.call(body, "executionCapabilities");
             const { device, token } = await createRemoteDevice({
                 ownerEmail: ctx.ownerEmail,
                 orgId: ctx.orgId,
@@ -792,7 +832,16 @@ export function createIntegrationsPlugin(options) {
                 platform: readString(body.platform),
                 appVersion: readString(body.appVersion) ?? readString(body.version),
                 hostName: readString(body.hostName) ?? readString(body.hostname),
-                metadata: readObject(body.metadata),
+                metadata: metadata || hasExecutionCapabilities
+                    ? {
+                        ...(metadata ?? {}),
+                        ...(hasExecutionCapabilities
+                            ? {
+                                executionCapabilities: readRemoteExecutionCapabilities(body.executionCapabilities),
+                            }
+                            : {}),
+                    }
+                    : null,
             });
             return { device: toPublicRemoteDevice(device), token };
         }));
@@ -1224,7 +1273,8 @@ export function createIntegrationsPlugin(options) {
             let pollingDevice = device;
             if (method === "POST" &&
                 (Object.prototype.hasOwnProperty.call(body, "computerCapabilities") ||
-                    Object.prototype.hasOwnProperty.call(body, "browserSession"))) {
+                    Object.prototype.hasOwnProperty.call(body, "browserSession") ||
+                    Object.prototype.hasOwnProperty.call(body, "executionCapabilities"))) {
                 const updated = await updateRemoteDeviceDetails({
                     id: device.id,
                     metadata: {
@@ -1234,6 +1284,11 @@ export function createIntegrationsPlugin(options) {
                                 computerCapabilities: readComputerCapabilities(body.computerCapabilities),
                             }
                             : {}),
+                        ...(Object.prototype.hasOwnProperty.call(body, "executionCapabilities")
+                            ? {
+                                executionCapabilities: readRemoteExecutionCapabilities(body.executionCapabilities),
+                            }
+                            : {}),
                         ...(Object.prototype.hasOwnProperty.call(body, "browserSession")
                             ? { browserSession: readBrowserSession(body.browserSession) }
                             : {}),
@@ -2753,6 +2808,40 @@ function readComputerCapabilities(value) {
         desktop: readSurface(input?.desktop, true),
     };
 }
+function readRemoteExecutionCapabilities(value) {
+    const input = readObject(value);
+    if (!input)
+        return {};
+    const backend = readString(input.backend);
+    const persistence = readString(input.persistence);
+    const list = (candidate, max) => [
+        ...new Set(Array.isArray(candidate)
+            ? candidate
+                .filter((entry) => typeof entry === "string")
+                .map((entry) => entry.trim().slice(0, 120))
+                .filter(Boolean)
+            : []),
+    ].slice(0, max);
+    return {
+        ...(backend === "desktop" ||
+            backend === "container" ||
+            backend === "kubernetes" ||
+            backend === "external"
+            ? { backend }
+            : {}),
+        workloads: list(input.workloads, 16),
+        engines: list(input.engines, 32),
+        ...(typeof input.acceptsScheduledWork === "boolean"
+            ? { acceptsScheduledWork: input.acceptsScheduledWork }
+            : {}),
+        ...(persistence === "local-files" ||
+            persistence === "persistent-volume" ||
+            persistence === "ephemeral"
+            ? { persistence }
+            : {}),
+        adapters: list(input.adapters, 32),
+    };
+}
 function readBrowserSession(value) {
     if (value === null)
         return null;

package/dist/integrations/remote-commands-store.d.ts

@@ -8,6 +8,7 @@ export declare function enqueueRemoteCommand(input: {
     params?: unknown;
     platform?: string | null;
     externalThreadId?: string | null;
+    idempotencyKey?: string | null;
     nextCheckAt?: number;
 }): Promise<RemoteCommand>;
 export declare function enqueueComputerCommand(input: {
@@ -18,6 +19,10 @@ export declare function enqueueComputerCommand(input: {
     platform?: string | null;
 }): Promise<RemoteCommand>;
 export declare function getRemoteCommand(id: string): Promise<RemoteCommand | null>;
+export declare function getRemoteCommandByIdempotencyKey(input: {
+    deviceId: string;
+    idempotencyKey: string;
+}): Promise<RemoteCommand | null>;
 export declare function listRemoteCommandsForOwner(input: {
     ownerEmail: string;
     orgId?: string | null;

package/dist/integrations/remote-commands-store.js

@@ -83,6 +83,7 @@ function rowToCommand(row) {
         result: parseJson(row.result_json, null),
         platform: row.platform ?? null,
         externalThreadId: row.external_thread_id ?? null,
+        idempotencyKey: row.idempotency_key ?? null,
         computerOperation: row.kind === "computer-operation"
             ? (params?.envelope ?? null)
             : null,
@@ -151,28 +152,52 @@ export async function enqueueRemoteCommand(input) {
     const client = getDbExec();
     const now = Date.now();
     const id = `remote-command-${now}-${randomHex(8)}`;
-    await client.execute({
-        sql: `INSERT INTO integration_remote_commands
-      (id, device_id, owner_email, org_id, kind, params_json, status, result_json,
-       platform, external_thread_id, attempts, next_check_at, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        args: [
-            id,
-            input.deviceId,
-            input.ownerEmail,
-            input.orgId ?? null,
-            input.kind,
-            JSON.stringify(input.params ?? {}),
-            "pending",
-            null,
-            input.platform ?? null,
-            input.externalThreadId ?? null,
-            0,
-            input.nextCheckAt ?? now,
-            now,
-            now,
-        ],
-    });
+    const idempotencyKey = normalizeIdempotencyKey(input.idempotencyKey);
+    if (idempotencyKey) {
+        const existing = await getRemoteCommandByIdempotencyKey({
+            deviceId: input.deviceId,
+            idempotencyKey,
+        });
+        if (existing)
+            return existing;
+    }
+    try {
+        await client.execute({
+            sql: `INSERT INTO integration_remote_commands
+        (id, device_id, owner_email, org_id, kind, params_json, status, result_json,
+         platform, external_thread_id, idempotency_key, attempts, next_check_at,
+         created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+            args: [
+                id,
+                input.deviceId,
+                input.ownerEmail,
+                input.orgId ?? null,
+                input.kind,
+                JSON.stringify(input.params ?? {}),
+                "pending",
+                null,
+                input.platform ?? null,
+                input.externalThreadId ?? null,
+                idempotencyKey,
+                0,
+                input.nextCheckAt ?? now,
+                now,
+                now,
+            ],
+        });
+    }
+    catch (error) {
+        if (idempotencyKey && isUniqueConstraintError(error)) {
+            const existing = await getRemoteCommandByIdempotencyKey({
+                deviceId: input.deviceId,
+                idempotencyKey,
+            });
+            if (existing)
+                return existing;
+        }
+        throw error;
+    }
     const command = await getRemoteCommand(id);
     if (!command)
         throw new Error("remote command insert failed");
@@ -259,6 +284,16 @@ export async function getRemoteCommand(id) {
     });
     return rows[0] ? rowToCommand(rows[0]) : null;
 }
+export async function getRemoteCommandByIdempotencyKey(input) {
+    await ensureTable();
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT * FROM integration_remote_commands
+          WHERE device_id = ? AND idempotency_key = ?
+          LIMIT 1`,
+        args: [input.deviceId, input.idempotencyKey],
+    });
+    return rows[0] ? rowToCommand(rows[0]) : null;
+}
 export async function listRemoteCommandsForOwner(input) {
     await ensureTable();
     const limit = Math.max(1, Math.min(input.limit ?? 100, 250));
@@ -529,6 +564,12 @@ function randomHex(byteLength) {
         .map((byte) => byte.toString(16).padStart(2, "0"))
         .join("");
 }
+function normalizeIdempotencyKey(value) {
+    if (typeof value !== "string")
+        return null;
+    const normalized = value.trim();
+    return normalized ? normalized.slice(0, 512) : null;
+}
 function affectedRows(result) {
     return (result.rowsAffected ??
         Number(result.rowCount ?? 0));

package/dist/integrations/remote-devices-store.d.ts

@@ -1,6 +1,7 @@
-import type { PublicRemoteDevice, RemoteComputerCapabilities, RemoteDevice, RemoteDeviceMetadata } from "./remote-types.js";
+import type { PublicRemoteDevice, RemoteComputerCapabilities, RemoteDevice, RemoteDeviceMetadata, RemoteExecutionCapabilities } from "./remote-types.js";
 export declare function toPublicRemoteDevice(device: RemoteDevice): PublicRemoteDevice;
 export declare function getRemoteComputerCapabilities(device: Pick<RemoteDevice, "metadata">): RemoteComputerCapabilities | null;
+export declare function getRemoteExecutionCapabilities(device: Pick<RemoteDevice, "metadata">): RemoteExecutionCapabilities | null;
 export declare function createRemoteDevice(input: {
     ownerEmail: string;
     orgId?: string | null;

package/dist/integrations/remote-devices-store.js

@@ -115,6 +115,12 @@ export function getRemoteComputerCapabilities(device) {
         return null;
     return normalizeComputerCapabilities(value);
 }
+export function getRemoteExecutionCapabilities(device) {
+    const value = device.metadata?.executionCapabilities;
+    if (!value || typeof value !== "object")
+        return null;
+    return normalizeExecutionCapabilities(value);
+}
 export async function createRemoteDevice(input) {
     await ensureTable();
     const client = getDbExec();
@@ -334,6 +340,9 @@ function serializeRemoteDeviceMetadata(metadata) {
     if (metadata.computerCapabilities !== undefined) {
         normalized.computerCapabilities = normalizeComputerCapabilities(metadata.computerCapabilities);
     }
+    if (metadata.executionCapabilities !== undefined) {
+        normalized.executionCapabilities = normalizeExecutionCapabilities(metadata.executionCapabilities);
+    }
     const json = JSON.stringify(normalized);
     if (new TextEncoder().encode(json).byteLength > 32_768) {
         throw new Error("Remote device metadata exceeds 32 KiB");
@@ -365,6 +374,43 @@ function normalizeComputerCapabilities(value) {
     }
     return result;
 }
+function normalizeExecutionCapabilities(value) {
+    const result = {};
+    if (value.backend === "desktop" ||
+        value.backend === "container" ||
+        value.backend === "kubernetes" ||
+        value.backend === "external") {
+        result.backend = value.backend;
+    }
+    if (Array.isArray(value.workloads)) {
+        result.workloads = normalizeStringList(value.workloads, 16).filter((entry) => entry === "code-agent" ||
+            entry === "scheduled-code" ||
+            entry === "external-agent");
+    }
+    if (Array.isArray(value.engines)) {
+        result.engines = normalizeStringList(value.engines, 32);
+    }
+    if (typeof value.acceptsScheduledWork === "boolean") {
+        result.acceptsScheduledWork = value.acceptsScheduledWork;
+    }
+    if (value.persistence === "local-files" ||
+        value.persistence === "persistent-volume" ||
+        value.persistence === "ephemeral") {
+        result.persistence = value.persistence;
+    }
+    if (Array.isArray(value.adapters)) {
+        result.adapters = normalizeStringList(value.adapters, 32);
+    }
+    return result;
+}
+function normalizeStringList(value, max) {
+    return [
+        ...new Set(value
+            .filter((entry) => typeof entry === "string")
+            .map((entry) => entry.trim().slice(0, 120))
+            .filter(Boolean)),
+    ].slice(0, max);
+}
 function looksLikeLargeBase64(value) {
     return value.length > 4_096 && /[A-Za-z0-9+/]{4_096,}={0,2}/.test(value);
 }

package/dist/integrations/remote-types.d.ts

@@ -1,4 +1,22 @@
 export type RemoteCommandKind = "create-run" | "list-runs" | "get-run" | "append-followup" | "approve" | "deny" | "stop" | "status" | "computer-operation";
+/** Workloads a paired execution host may accept from the relay. */
+export type RemoteExecutionWorkload = "code-agent" | "scheduled-code" | "external-agent";
+export type RemoteExecutionBackend = "desktop" | "container" | "kubernetes" | "external";
+export type RemoteExecutionPersistence = "local-files" | "persistent-volume" | "ephemeral";
+/**
+ * Non-secret capabilities advertised by a host during its heartbeat. The
+ * relay uses this to reject a requested workload before queueing it, while
+ * leaving room for a future Kubernetes or external-agent adapter.
+ */
+export interface RemoteExecutionCapabilities {
+    backend?: RemoteExecutionBackend;
+    workloads?: RemoteExecutionWorkload[];
+    engines?: string[];
+    acceptsScheduledWork?: boolean;
+    acceptsPortalHandoffs?: boolean;
+    persistence?: RemoteExecutionPersistence;
+    adapters?: string[];
+}
 export type ComputerOperationClass = "browser.observe" | "browser.control" | "desktop.observe" | "desktop.control";
 export type ComputerApprovalScope = "once" | "run" | "task";
 export interface ComputerCommandAction {
@@ -40,6 +58,7 @@ export interface RemoteComputerCapabilities {
 }
 export interface RemoteDeviceMetadata extends Record<string, unknown> {
     computerCapabilities?: RemoteComputerCapabilities;
+    executionCapabilities?: RemoteExecutionCapabilities;
 }
 export type RemoteCommandStatus = "pending" | "claimed" | "running" | "completed" | "failed";
 export type RemoteDeviceStatus = "active" | "inactive";
@@ -85,6 +104,7 @@ export interface RemoteCommand {
     result: unknown;
     platform: string | null;
     externalThreadId: string | null;
+    idempotencyKey?: string | null;
     computerOperation?: ComputerCommandEnvelope | null;
     attempts: number;
     nextCheckAt: number;

package/dist/jobs/actions/list-recurring-jobs.d.ts

@@ -14,6 +14,9 @@ export interface RecurringJobActionItem {
     lastError: string | null;
     nextRun: string | null;
     createdBy: string | null;
+    executionHostId: string | null;
+    executionEngine: string | null;
+    executionCwd: string | null;
     mcpTools: string[];
     canUpdate: boolean;
 }

package/dist/jobs/actions/list-recurring-jobs.js

@@ -59,7 +59,8 @@ export default defineAction({
             const { meta, body } = parseJobFrontmatter(full.content);
             if (!jobBelongsToApp(meta, ctx?.appId))
                 continue;
-            const canUpdate = scope === "personal" || !(await authorizeJobMutation(owner, meta));
+            const canUpdate = scope === "personal" ||
+                (await authorizeJobMutation(owner, meta)) === null;
             jobs.push({
                 id: full.id,
                 name: jobName(full.path),
@@ -78,6 +79,9 @@ export default defineAction({
                 lastError: meta.lastError ?? null,
                 nextRun: nextRun(meta),
                 createdBy: meta.createdBy ?? null,
+                executionHostId: meta.executionHostId ?? null,
+                executionEngine: meta.executionEngine ?? null,
+                executionCwd: meta.executionCwd ?? null,
                 mcpTools: meta.mcpTools ?? [],
                 canUpdate,
             });

package/dist/jobs/frontmatter.d.ts

@@ -52,6 +52,22 @@ export interface JobFrontmatter {
     domain?: string;
     /** Explicit application owner used by the recurring-job scheduler. */
     appId?: string;
+    /** Optional paired execution host for code-agent work. */
+    executionHostId?: string;
+    /** Optional engine id understood by the selected execution host. */
+    executionEngine?: string;
+    /** Optional host-local workspace path used by code-agent work. */
+    executionCwd?: string;
+    /** Stable remote dispatch key for a running host-targeted job. */
+    remoteRequestId?: string;
+    /** Durable relay command id for a running host-targeted job. */
+    remoteCommandId?: string;
+    /** Durable remote code-agent run id, when the host has started one. */
+    remoteRunId?: string;
+    /** Durable automation history row associated with the remote dispatch. */
+    remoteAutomationRunId?: string;
+    /** Whether a completed remote dispatch should advance the cron schedule. */
+    remoteAdvanceSchedule?: boolean;
     /**
      * Optional application-owned policy id carried into actions by the trusted
      * trigger dispatcher. It is not model-supplied action input.

package/dist/jobs/frontmatter.js

@@ -18,6 +18,15 @@ const MAX_JOB_MCP_TOOLS = 64;
 const JOB_MCP_TOOL_NAME_RE = /^mcp__[^\s]+__[^\s]+$/;
 const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n)?([\s\S]*)$/;
 const DELEGATED_POLICY_ID_RE = /^[a-z0-9][a-z0-9._:-]{0,127}$/i;
+const EXECUTION_ID_RE = /^[a-z0-9][a-z0-9._:-]{0,127}$/i;
+const REMOTE_ID_RE = /^[a-z0-9][a-z0-9@+._:/-]{0,511}$/i;
+function assertBoundedFrontmatterValue(value, label, pattern) {
+    if (value === undefined)
+        return;
+    if (!pattern.test(value)) {
+        throw new Error(`${label} must be a bounded opaque identifier.`);
+    }
+}
 /**
  * Normalize the non-secret MCP capability references persisted with a job.
  * Tool names are opaque framework identifiers; URLs and credentials never
@@ -159,6 +168,30 @@ function parseKnownField(meta, key, rawValue) {
         case "appId":
             meta.appId = value || undefined;
             break;
+        case "executionHostId":
+            meta.executionHostId = value || undefined;
+            break;
+        case "executionEngine":
+            meta.executionEngine = value || undefined;
+            break;
+        case "executionCwd":
+            meta.executionCwd = value || undefined;
+            break;
+        case "remoteRequestId":
+            meta.remoteRequestId = value || undefined;
+            break;
+        case "remoteCommandId":
+            meta.remoteCommandId = value || undefined;
+            break;
+        case "remoteRunId":
+            meta.remoteRunId = value || undefined;
+            break;
+        case "remoteAutomationRunId":
+            meta.remoteAutomationRunId = value || undefined;
+            break;
+        case "remoteAdvanceSchedule":
+            meta.remoteAdvanceSchedule = value !== "false";
+            break;
         case "delegatedPolicyId":
             meta.delegatedPolicyId = value || undefined;
             break;
@@ -211,6 +244,16 @@ export function buildJobResourceContent(meta, body) {
         !DELEGATED_POLICY_ID_RE.test(meta.delegatedPolicyId)) {
         throw new Error("Delegated automation policy IDs must be 1-128 letters, numbers, dots, underscores, colons, or hyphens.");
     }
+    assertBoundedFrontmatterValue(meta.executionHostId, "Execution host IDs", EXECUTION_ID_RE);
+    assertBoundedFrontmatterValue(meta.executionEngine, "Execution engine IDs", EXECUTION_ID_RE);
+    assertBoundedFrontmatterValue(meta.remoteRequestId, "Remote request IDs", REMOTE_ID_RE);
+    assertBoundedFrontmatterValue(meta.remoteCommandId, "Remote command IDs", REMOTE_ID_RE);
+    assertBoundedFrontmatterValue(meta.remoteRunId, "Remote run IDs", REMOTE_ID_RE);
+    assertBoundedFrontmatterValue(meta.remoteAutomationRunId, "Remote automation run IDs", REMOTE_ID_RE);
+    if (meta.executionCwd !== undefined &&
+        (meta.executionCwd.length > 1024 || /[\r\n]/.test(meta.executionCwd))) {
+        throw new Error("Execution workspace paths must be at most 1024 characters.");
+    }
     const lines = [
         "---",
         `schedule: ${JSON.stringify(meta.schedule)}`,
@@ -225,6 +268,16 @@ export function buildJobResourceContent(meta, body) {
     pushString(lines, "domain", meta.domain);
     pushString(lines, "appId", meta.appId);
     pushString(lines, "delegatedPolicyId", meta.delegatedPolicyId);
+    pushString(lines, "executionHostId", meta.executionHostId);
+    pushString(lines, "executionEngine", meta.executionEngine);
+    pushString(lines, "executionCwd", meta.executionCwd);
+    pushString(lines, "remoteRequestId", meta.remoteRequestId);
+    pushString(lines, "remoteCommandId", meta.remoteCommandId);
+    pushString(lines, "remoteRunId", meta.remoteRunId);
+    pushString(lines, "remoteAutomationRunId", meta.remoteAutomationRunId);
+    if (meta.remoteAdvanceSchedule !== undefined) {
+        lines.push(`remoteAdvanceSchedule: ${meta.remoteAdvanceSchedule}`);
+    }
     // Keep the long-standing human-readable owner shape used by existing
     // resources and diagnostics; values that can contain free-form text use
     // JSON quoting below.

package/dist/jobs/remote-execution.d.ts

@@ -0,0 +1,42 @@
+import type { RemoteCommand } from "../integrations/remote-types.js";
+import { type Resource } from "../resources/store.js";
+import { type JobFrontmatter } from "./frontmatter.js";
+/** A remote run is allowed to be long-lived, but never indefinitely invisible. */
+export declare const REMOTE_AUTOMATION_MAX_ACTIVE_MS: number;
+export type RemoteAutomationState = "not-remote" | "active" | "completed" | "failed";
+export interface RemoteAutomationStatus {
+    state: RemoteAutomationState;
+    command?: RemoteCommand;
+    error?: string;
+}
+export interface RemoteAutomationDispatchInput {
+    resource: Resource;
+    meta: JobFrontmatter;
+    body: string;
+    ownerEmail: string;
+    orgId?: string;
+    appId?: string;
+    prompt: string;
+    title: string;
+    historyId?: string;
+    /** Whether completing this remote dispatch should advance its cron schedule. */
+    advanceSchedule?: boolean;
+    now?: Date;
+}
+/**
+ * Queue one host-targeted automation. The request key is derived from the
+ * persisted start timestamp, so a worker crash between the queue write and
+ * resource bookkeeping cannot create a second remote run.
+ */
+export declare function dispatchRemoteAutomation(input: RemoteAutomationDispatchInput): Promise<{
+    command: RemoteCommand;
+    requestId: string;
+    automationRunId?: string;
+}>;
+export declare function getRemoteAutomationStatus(input: {
+    meta: JobFrontmatter;
+    ownerEmail: string;
+    orgId?: string;
+    now?: Date;
+}): Promise<RemoteAutomationStatus>;
+export declare function finishRemoteAutomationHistory(meta: Pick<JobFrontmatter, "remoteAutomationRunId">, state: "completed" | "failed", error?: string): Promise<void>;