@agent-native/core 0.169.1 → 0.171.0

package/dist/agent/run-store.js

@@ -705,6 +705,67 @@ function backgroundAwareStaleCutoffSql() {
     // working, and nothing recovers it. Those get the wider background window.
     return `(CAST(? AS BIGINT) - CASE WHEN dispatch_mode = 'background-processing' AND dispatch_payload IS NOT NULL THEN ${BACKGROUND_PROCESSING_RUN_STALE_MS} WHEN dispatch_mode LIKE 'background%' THEN ${BACKGROUND_RUN_STALE_MS} ELSE ${RUN_STALE_MS} END)`;
 }
+/**
+ * Which stale window the reaper applied to a row, in ms.
+ *
+ * MIRRORS `backgroundAwareStaleCutoffSql`, which decides the same thing in SQL
+ * because it has to run inside the conditional UPDATE. Kept beside it and
+ * covered by a test asserting the three cases agree — a drift here reports the
+ * wrong window on a real incident, which is worse than reporting none.
+ */
+export function staleWindowMsForRow(row) {
+    if (typeof row.maxStaleMs === "number")
+        return row.maxStaleMs;
+    const mode = row.dispatchMode ?? "";
+    if (mode === "background-processing" && row.hasDispatchPayload)
+        return BACKGROUND_PROCESSING_RUN_STALE_MS;
+    if (mode.startsWith("background"))
+        return BACKGROUND_RUN_STALE_MS;
+    return RUN_STALE_MS;
+}
+/**
+ * The liveness forensics for one reap, as a compact `key=value` line.
+ *
+ * THE FIELD THAT MATTERS IS `hbAheadOfProgress`. A worker that died takes its
+ * heartbeat with it, so heartbeat and last-progress stop together and this is
+ * ~0. A worker still running while the agent loop stops producing keeps
+ * heartbeating, and this grows without bound — those are opposite bugs that
+ * look identical in `agent_runs` today. Production showed runs where the
+ * heartbeat ran 3,000s past the last progress; nothing recorded that, so
+ * nothing could act on it.
+ *
+ * Numbers, booleans and an enum only — no prompt, no result, no user content —
+ * so this obeys the same privacy rule as event properties and log lines.
+ */
+export function describeStaleReap(row) {
+    const { now } = row;
+    const started = row.startedAt ?? null;
+    const heartbeat = row.heartbeatAt ?? null;
+    const progress = row.lastProgressAt ?? null;
+    const liveness = Math.max(progress ?? started ?? 0, heartbeat ?? started ?? 0);
+    const parts = [
+        `window=${staleWindowMsForRow(row)}`,
+        `dispatch=${row.dispatchMode ?? "none"}`,
+        `redispatchable=${row.hasDispatchPayload ? "1" : "0"}`,
+    ];
+    if (heartbeat != null)
+        parts.push(`sinceHeartbeat=${now - heartbeat}`);
+    if (progress != null)
+        parts.push(`sinceProgress=${now - progress}`);
+    // The discriminator. Negative would mean progress outlived the heartbeat,
+    // which is possible and equally worth seeing.
+    if (heartbeat != null && progress != null)
+        parts.push(`hbAheadOfProgress=${heartbeat - progress}`);
+    // Only when it is a real duration. A liveness basis before `started_at` means
+    // clock skew or a mocked row, and printing a negative age reads as a fact
+    // about the run rather than a fact about the clock.
+    if (started != null && liveness >= started)
+        parts.push(`runAge=${liveness - started}`);
+    parts.push(`inFlight=${row.inFlightSince != null ? "1" : "0"}`);
+    if (row.inFlightSince != null)
+        parts.push(`inFlightFor=${now - row.inFlightSince}`);
+    return parts.join(" ");
+}
 function terminalRunEventExclusionSql(runIdColumn = "id") {
     return `NOT EXISTS (
     SELECT 1 FROM agent_run_events terminal_events
@@ -1302,6 +1363,24 @@ export const RUN_DIAG_STAGE = {
      * no boundary previously recorded anywhere.
      */
     runBoundaryReached: "run_boundary_reached",
+    /**
+     * A stale reaper flipped this run to `errored`. Detail carries the liveness
+     * forensics — see `describeStaleReap`.
+     *
+     * WHY THIS EXISTS. `stale_run` is the single largest terminal outcome on the
+     * one-shot automation path (14 of 27 runs in one production deployment) and
+     * the row records nothing about WHY: `error_detail` is a fixed sentence for
+     * every reap, so a correct reap and a false one are indistinguishable after
+     * the fact. Every question worth asking needed a number nobody stored — was
+     * the worker dead, or was it heartbeating happily while the loop stopped
+     * producing? which of the three stale windows fired? was the in-flight grace
+     * in play? One production run heartbeated 3,309s past a 600s hard abort and
+     * there is no way to tell from the row what kept it alive.
+     *
+     * Diagnostics only: nothing reads this to make a decision, and it cannot
+     * change whether a row is reaped.
+     */
+    staleRunReaped: "stale_run_reaped",
 };
 /**
  * Record the last reached pipeline stage (+ optional short detail) for a run.
@@ -1732,15 +1811,59 @@ async function reapSingleStaleRun(runId, maxStaleMs) {
         });
         reaped = (rowsAffected ?? 0) > 0;
     }
+    // FORENSICS, on the reap path only. A speculative `reapIfStale` that reaps
+    // nothing does no extra work; an actual reap is rare enough to afford one
+    // read.
+    //
+    // ONE diagnostic write, not two. `diag_stage` holds a single value, so an
+    // independent forensics write would overwrite the recovery outcome that
+    // already lands here — trading the answer to "did a successor get created"
+    // for the answer to "why did it die". Both fit in one line, so both are
+    // recorded: the recovery outcome keeps its own stage name and leading
+    // position, and the liveness numbers are appended.
+    let forensics = "";
+    if (reaped) {
+        forensics = await client
+            .execute({
+            sql: `SELECT started_at, heartbeat_at, last_progress_at, in_flight_since,
+                     dispatch_mode, dispatch_payload
+                FROM agent_runs WHERE id = ?`,
+            args: [runId],
+        })
+            .then((res) => {
+            const row = res.rows[0];
+            if (!row)
+                return "forensics=row_missing";
+            const num = (v) => (v == null ? null : Number(v));
+            return describeStaleReap({
+                startedAt: num(row.started_at),
+                heartbeatAt: num(row.heartbeat_at),
+                lastProgressAt: num(row.last_progress_at),
+                inFlightSince: num(row.in_flight_since),
+                dispatchMode: row.dispatch_mode ?? null,
+                hasDispatchPayload: row.dispatch_payload != null,
+                ...(typeof maxStaleMs === "number" ? { maxStaleMs } : {}),
+                now: completedAt,
+            });
+        })
+            // Best-effort throughout: a diagnostic that could fail a reap would be
+            // strictly worse than no diagnostic. But an empty string reads as "reaped
+            // with nothing worth saying" — the exact ambiguity these forensics exist
+            // to remove — so an unreadable row says so instead of going quiet.
+            .catch((err) => `forensics=unreadable ${(err instanceof Error ? err.message : String(err)).slice(0, 120)}`);
+    }
     if (reaped && outcome && outcome.outcome !== "not_background") {
         const detail = outcome.outcome === "recovered"
             ? `recovered successorRunId=${outcome.successorRunId}`
             : `declined reason=${outcome.outcome}`;
-        await recordRunDiagnostic(runId, RUN_DIAG_STAGE.staleRunRecoveryAttempted, detail).catch(() => { });
+        await recordRunDiagnostic(runId, RUN_DIAG_STAGE.staleRunRecoveryAttempted, forensics ? `${detail} ${forensics}` : detail).catch(() => { });
         if (outcome.outcome === "recovered") {
             attemptStaleRunRecoveryDispatch(outcome.successorRunId);
         }
     }
+    else if (reaped && forensics) {
+        await recordRunDiagnostic(runId, RUN_DIAG_STAGE.staleRunReaped, forensics).catch(() => { });
+    }
     return reaped;
 }
 /**

package/dist/agent/tool-search.js

@@ -1,3 +1,4 @@
+import { isActionHiddenFromEveryAgentSurface } from "../action.js";
 import { parseMcpToolName } from "../mcp-client/manager.js";
 import { isMcpToolAllowedForRequest } from "../mcp-client/visibility.js";
 import { getRequestRunContext } from "../server/request-context.js";
@@ -84,7 +85,7 @@ export function searchToolRegistry(registry, args = {}, options = {}) {
     for (const [name, entry] of Object.entries(registry)) {
         if (!entry?.tool || name === TOOL_SEARCH_ACTION_NAME)
             continue;
-        if (entry.agentTool === false)
+        if (isActionHiddenFromEveryAgentSurface(entry))
             continue;
         if (name.startsWith("mcp__") && !isMcpToolAllowedForRequest(name)) {
             continue;

package/dist/agent/types.d.ts

@@ -291,12 +291,17 @@ export type AgentChatEvent = {
      * without producing any forwarded event, so the backstop's clock saw pure
      * silence and killed demonstrably-alive runs at 150s. `trackInFlightWork`
      * counts this pair exactly like `tool_start`/`tool_done`: an engine call
-     * in flight suspends the backstop, bounded by the in-loop watchdog the
-     * same way a tool call is bounded by its own timeout.
+     * in flight suspends the backstop.
+     *
+     * WHAT BOUNDS THE SUSPENDED WINDOW, now that the in-loop watchdogs are
+     * gone: the engine's own first-event abort covers a call that never
+     * speaks, and the chunk/run budget covers everything after that. An
+     * in-stream wedge AFTER the first frame is therefore caught by the budget
+     * rather than by a dedicated clock — a deliberate trade, because no clock
+     * here could tell it apart from a model composing a large tool argument.
      *
      * Deliberately NOT a keepalive: a keepalive proves the transport is up,
-     * this proves the loop is inside a model call it will be held accountable
-     * for by `MODEL_STREAM_NO_PROGRESS_TIMEOUT_MS`.
+     * this proves the loop is inside a model call.
      */
     type: "model_stream";
     status: "start" | "end";

package/dist/app-config/auth.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
 export declare const authConfig: z.ZodObject<{
     disableDesktopSsoFallbackInDevelopment: z.ZodDefault<z.ZodBoolean>;
+    requireEmailVerification: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;

package/dist/app-config/auth.js

@@ -4,4 +4,11 @@ export const authConfig = z.object({
         env: "AGENT_NATIVE_DISABLE_DESKTOP_SSO_FALLBACK",
         doc: "Disable the loopback Desktop SSO fallback in development so isolated acceptance runs can use their configured local identity. Ignored in production.",
     }),
+    // Deliberately optional rather than defaulted: unset means "derive from the
+    // deployment", which is not a boolean. A default here would erase the
+    // difference between an operator who chose a policy and one who never spoke.
+    requireEmailVerification: z.boolean().optional().meta({
+        env: "AUTH_REQUIRE_EMAIL_VERIFICATION",
+        doc: "Whether password signup must verify the email address before it gets a session. Unset derives it: hosted deployments require it, local development skips it. Setting it false accepts an unverified email as a login credential, including in production.",
+    }),
 });

package/dist/app-config/configuration-error.d.ts

@@ -0,0 +1,11 @@
+/**
+ * An invalid deployment configuration value, as opposed to a runtime failure.
+ *
+ * Best-effort regions that log and continue — plugin auto-mount, most of all —
+ * must rethrow this rather than absorb it: a typo in a deployment variable
+ * silently drops whole route trees, so the deployment looks accepted while the
+ * app is missing.
+ */
+export declare class AppConfigurationError extends Error {
+    constructor(message: string);
+}

package/dist/app-config/configuration-error.js

@@ -0,0 +1,14 @@
+/**
+ * An invalid deployment configuration value, as opposed to a runtime failure.
+ *
+ * Best-effort regions that log and continue — plugin auto-mount, most of all —
+ * must rethrow this rather than absorb it: a typo in a deployment variable
+ * silently drops whole route trees, so the deployment looks accepted while the
+ * app is missing.
+ */
+export class AppConfigurationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AppConfigurationError";
+    }
+}

package/dist/app-config/index.d.ts

@@ -1,2 +1,3 @@
 export { defineAppConfig, getAppConfig, resetAppConfigForTests, } from "./store.js";
+export { AppConfigurationError } from "./configuration-error.js";
 export { appConfigSchema, type AppConfig, type AppConfigInput, } from "./schema.js";

package/dist/app-config/index.js

@@ -1,2 +1,3 @@
 export { defineAppConfig, getAppConfig, resetAppConfigForTests, } from "./store.js";
+export { AppConfigurationError } from "./configuration-error.js";
 export { appConfigSchema, } from "./schema.js";

package/dist/app-config/integrations.d.ts

@@ -2,4 +2,5 @@ import { z } from "zod";
 /** Inbound integration webhook policy. */
 export declare const integrationsConfig: z.ZodObject<{
     allowUnverifiedWebhooks: z.ZodDefault<z.ZodBoolean>;
+    platforms: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;

package/dist/app-config/integrations.js

@@ -8,4 +8,14 @@ export const integrationsConfig = z.object({
         env: ["AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS"],
         doc: "Skip inbound webhook signature verification. Development only — every adapter that reads this treats it as a bypass of sender authentication.",
     }),
+    // Blank counts as unset everywhere in the env layer, so this cannot express
+    // "mount no platforms" — refuse the whole slot with `plugins.disabled`
+    // instead.
+    platforms: z
+        .array(z.string().min(1))
+        .optional()
+        .meta({
+        env: ["AGENT_NATIVE_INTEGRATION_PLATFORMS"],
+        doc: "Integration platforms to mount, comma-separated, each matched against an adapter's `platform` id (slack, telegram, whatsapp, microsoft-teams, discord, google-docs, email). Unset mounts every adapter; a name no adapter provides throws at plugin init.",
+    }),
 });

package/dist/app-config/plugins.d.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+/**
+ * The framework's default plugin slots, mirroring `DEFAULT_PLUGIN_REGISTRY`.
+ *
+ * Spelled out here rather than imported: that registry lives in the deploy
+ * layer, which reaches for `node:fs`, and this schema is parsed on edge
+ * runtimes too. `plugins.spec.ts` fails when the two lists drift.
+ */
+export declare const DEFAULT_PLUGIN_SLOTS: readonly ["agent-chat", "auth", "context-xray", "core-routes", "integrations", "observational-memory", "onboarding", "org", "resources", "sentry", "terminal"];
+export type DefaultPluginSlot = (typeof DEFAULT_PLUGIN_SLOTS)[number];
+/**
+ * Which framework default plugins this deployment refuses.
+ *
+ * A refused slot mounts nothing, so every route it owns 404s and the UI and
+ * agent surfaces that call them stop working — `agent-chat`, `auth`, and
+ * `core-routes` carry most of an app with them. Only the framework's own
+ * default is withheld: an app that ships `server/plugins/<slot>.ts` mounted
+ * that plugin deliberately and keeps it.
+ */
+export declare const pluginsConfig: z.ZodObject<{
+    disabled: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        "agent-chat": "agent-chat";
+        auth: "auth";
+        "context-xray": "context-xray";
+        "core-routes": "core-routes";
+        integrations: "integrations";
+        "observational-memory": "observational-memory";
+        onboarding: "onboarding";
+        org: "org";
+        resources: "resources";
+        sentry: "sentry";
+        terminal: "terminal";
+    }>>>;
+}, z.core.$strip>;

package/dist/app-config/plugins.js

@@ -0,0 +1,39 @@
+import { z } from "zod";
+/**
+ * The framework's default plugin slots, mirroring `DEFAULT_PLUGIN_REGISTRY`.
+ *
+ * Spelled out here rather than imported: that registry lives in the deploy
+ * layer, which reaches for `node:fs`, and this schema is parsed on edge
+ * runtimes too. `plugins.spec.ts` fails when the two lists drift.
+ */
+export const DEFAULT_PLUGIN_SLOTS = [
+    "agent-chat",
+    "auth",
+    "context-xray",
+    "core-routes",
+    "integrations",
+    "observational-memory",
+    "onboarding",
+    "org",
+    "resources",
+    "sentry",
+    "terminal",
+];
+/**
+ * Which framework default plugins this deployment refuses.
+ *
+ * A refused slot mounts nothing, so every route it owns 404s and the UI and
+ * agent surfaces that call them stop working — `agent-chat`, `auth`, and
+ * `core-routes` carry most of an app with them. Only the framework's own
+ * default is withheld: an app that ships `server/plugins/<slot>.ts` mounted
+ * that plugin deliberately and keeps it.
+ */
+export const pluginsConfig = z.object({
+    disabled: z
+        .array(z.enum(DEFAULT_PLUGIN_SLOTS))
+        .default([])
+        .meta({
+        env: ["AGENT_NATIVE_DISABLED_PLUGINS"],
+        doc: "Framework default plugins this deployment refuses to auto-mount, comma-separated. A refused slot mounts none of its routes; an app supplying its own `server/plugins/<slot>.ts` is unaffected.",
+    }),
+});

package/dist/app-config/run-lifecycle-invariants.d.ts

@@ -111,16 +111,25 @@ export declare const BACKGROUND_SOFT_TIMEOUT_CEILING_MS: number;
  */
 export declare const RUN_NO_PROGRESS_HARD_TIMEOUT_MS = 150000;
 /**
- * Default in-loop watchdog for silence while an action's arguments stream in.
- * Read through `resolveActionPreparationNoProgressTimeoutMs`, never directly:
- * a host diagnosing a timeout has to be able to see and change this number.
- */
-export declare const ACTION_PREPARATION_NO_PROGRESS_TIMEOUT_MS = 90000;
-/**
- * Default in-loop watchdog for silence between engine stream frames. Read
- * through `resolveModelStreamNoProgressTimeoutMs`, never directly.
+ * THE IN-LOOP NO-PROGRESS WATCHDOGS ARE GONE, and their absence is the design.
+ *
+ * Two 90s bounds used to live here — one on silence between engine frames,
+ * one on a tool input whose byte count stopped growing. Both inferred a dead
+ * stream from the absence of a particular event, and on the Anthropic
+ * transport that inference cannot be made: the SDK drops the provider's `ping`
+ * keepalives before any consumer sees them (`core/streaming.js`), so a model
+ * composing a large tool argument is indistinguishable from a wedged socket.
+ * Only a tool declared for eager input streaming emits anything at all while
+ * its arguments are generated, so the silent case is ORDINARY, not
+ * exceptional.
+ *
+ * They were added to make runs more reliable and did the opposite: of 27
+ * one-shot analyst runs in production, 2 completed. Deleting them leaves the
+ * bounds that key off evidence rather than absence — the engine's own
+ * first-event abort, the run-manager backstop outside the stream, the per-tool
+ * execution timeout, the chunk budget, and the stale reaper. Reintroducing a
+ * clock here needs a liveness signal this process can actually observe.
  */
-export declare const MODEL_STREAM_NO_PROGRESS_TIMEOUT_MS = 90000;
 /**
  * Consecutive chunks allowed to end on the SAME terminal error code having
  * produced nothing before the chain stops.

package/dist/app-config/run-lifecycle-invariants.js

@@ -110,16 +110,25 @@ export const BACKGROUND_SOFT_TIMEOUT_CEILING_MS = 13 * 60_000;
  */
 export const RUN_NO_PROGRESS_HARD_TIMEOUT_MS = 150_000;
 /**
- * Default in-loop watchdog for silence while an action's arguments stream in.
- * Read through `resolveActionPreparationNoProgressTimeoutMs`, never directly:
- * a host diagnosing a timeout has to be able to see and change this number.
- */
-export const ACTION_PREPARATION_NO_PROGRESS_TIMEOUT_MS = 90_000;
-/**
- * Default in-loop watchdog for silence between engine stream frames. Read
- * through `resolveModelStreamNoProgressTimeoutMs`, never directly.
+ * THE IN-LOOP NO-PROGRESS WATCHDOGS ARE GONE, and their absence is the design.
+ *
+ * Two 90s bounds used to live here — one on silence between engine frames,
+ * one on a tool input whose byte count stopped growing. Both inferred a dead
+ * stream from the absence of a particular event, and on the Anthropic
+ * transport that inference cannot be made: the SDK drops the provider's `ping`
+ * keepalives before any consumer sees them (`core/streaming.js`), so a model
+ * composing a large tool argument is indistinguishable from a wedged socket.
+ * Only a tool declared for eager input streaming emits anything at all while
+ * its arguments are generated, so the silent case is ORDINARY, not
+ * exceptional.
+ *
+ * They were added to make runs more reliable and did the opposite: of 27
+ * one-shot analyst runs in production, 2 completed. Deleting them leaves the
+ * bounds that key off evidence rather than absence — the engine's own
+ * first-event abort, the run-manager backstop outside the stream, the per-tool
+ * execution timeout, the chunk budget, and the stale reaper. Reintroducing a
+ * clock here needs a liveness signal this process can actually observe.
  */
-export const MODEL_STREAM_NO_PROGRESS_TIMEOUT_MS = 90_000;
 /**
  * Consecutive chunks allowed to end on the SAME terminal error code having
  * produced nothing before the chain stops.
@@ -226,8 +235,6 @@ export function assertRunLifecycleInvariants(agent) {
     // the relationship below extended to cover it.
     const { backgroundNoProgressTimeoutMs, backgroundRunHardTimeoutMs } = agent;
     const backgroundSoftTimeoutCeilingMs = BACKGROUND_SOFT_TIMEOUT_CEILING_MS;
-    const modelStreamNoProgressTimeoutMs = MODEL_STREAM_NO_PROGRESS_TIMEOUT_MS;
-    const actionPreparationNoProgressTimeoutMs = ACTION_PREPARATION_NO_PROGRESS_TIMEOUT_MS;
     const maxBackgroundRunContinuations = MAX_BACKGROUND_RUN_CONTINUATIONS;
     const maxConsecutiveNoProgressContinuations = MAX_CONSECUTIVE_NO_PROGRESS_CONTINUATIONS;
     const maxTurnWallClockMs = MAX_TURN_WALL_CLOCK_MS;
@@ -244,20 +251,6 @@ export function assertRunLifecycleInvariants(agent) {
     };
     // A disabled backstop (0) has no ordering to satisfy — it never fires.
     if (backgroundNoProgressTimeoutMs > 0) {
-        require("in-loop watchdog before the run-manager backstop", {
-            key: "agent.modelStreamNoProgressTimeoutMs",
-            value: modelStreamNoProgressTimeoutMs,
-        }, {
-            key: "agent.backgroundNoProgressTimeoutMs",
-            value: backgroundNoProgressTimeoutMs,
-        }, "the in-loop watchdog emits a boundary the agent loop itself recovers; the run-manager backstop is the coarser one above it");
-        require("action-preparation watchdog before the run-manager backstop", {
-            key: "agent.actionPreparationNoProgressTimeoutMs",
-            value: actionPreparationNoProgressTimeoutMs,
-        }, {
-            key: "agent.backgroundNoProgressTimeoutMs",
-            value: backgroundNoProgressTimeoutMs,
-        }, "a stalled argument stream must be caught by the watchdog that knows which tool stalled");
         require("background backstop inside the background chunk budget", {
             key: "agent.backgroundNoProgressTimeoutMs",
             value: backgroundNoProgressTimeoutMs,

package/dist/app-config/schema.d.ts

@@ -38,14 +38,31 @@ export declare const appConfigSchema: z.ZodObject<{
     }, z.core.$strip>>;
     auth: z.ZodPrefault<z.ZodObject<{
         disableDesktopSsoFallbackInDevelopment: z.ZodDefault<z.ZodBoolean>;
+        requireEmailVerification: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     integrations: z.ZodPrefault<z.ZodObject<{
         allowUnverifiedWebhooks: z.ZodDefault<z.ZodBoolean>;
+        platforms: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
     migration: z.ZodPrefault<z.ZodObject<{
         releaseMigrations: z.ZodDefault<z.ZodBoolean>;
         betaSchemaOwner: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
+    plugins: z.ZodPrefault<z.ZodObject<{
+        disabled: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            "agent-chat": "agent-chat";
+            auth: "auth";
+            "context-xray": "context-xray";
+            "core-routes": "core-routes";
+            integrations: "integrations";
+            "observational-memory": "observational-memory";
+            onboarding: "onboarding";
+            org: "org";
+            resources: "resources";
+            sentry: "sentry";
+            terminal: "terminal";
+        }>>>;
+    }, z.core.$strip>>;
     privateBlob: z.ZodPrefault<z.ZodObject<{
         provider: z.ZodOptional<z.ZodString>;
         publicUploadFallback: z.ZodDefault<z.ZodBoolean>;

package/dist/app-config/schema.js

@@ -5,6 +5,7 @@ import { appConfig } from "./app.js";
 import { authConfig } from "./auth.js";
 import { integrationsConfig } from "./integrations.js";
 import { migrationConfig } from "./migration.js";
+import { pluginsConfig } from "./plugins.js";
 import { privateBlobConfig } from "./private-blob.js";
 import { workspaceConfig } from "./workspace.js";
 /**
@@ -30,6 +31,7 @@ export const appConfigSchema = z.object({
     auth: authConfig.prefault({}),
     integrations: integrationsConfig.prefault({}),
     migration: migrationConfig.prefault({}),
+    plugins: pluginsConfig.prefault({}),
     privateBlob: privateBlobConfig.prefault({}),
     workspace: workspaceConfig.prefault({}),
 });

package/dist/chat-threads/schema-migrations.js

@@ -57,4 +57,24 @@ export const CHAT_THREAD_SCHEMA_MIGRATIONS = [
         ON chat_threads (share_token_hash)
     `,
     },
+    {
+        version: 3,
+        name: "chat-threads-source-backfill",
+        // Retires a `thread_data NOT LIKE '%…%'` filter the local-only list used to
+        // carry for integration rows written before `source_platform` existed. That
+        // predicate forced Postgres to detoast the full message-history blob for
+        // every scanned row, so the sidebar list cost seconds regardless of LIMIT.
+        // Paying the scan once here keeps the read path off the blob forever.
+        //
+        // The matching `LOWER(...)` expression indexes deliberately do NOT live
+        // here: they are built CONCURRENTLY in the store's ensure path, and
+        // Postgres forbids that inside the transaction `runMigrations` wraps
+        // around these statements.
+        sql: `
+      UPDATE chat_threads
+        SET source_platform = 'integration'
+        WHERE source_platform IS NULL
+          AND thread_data LIKE '%"integrationDeliveryAttempted":true%'
+    `,
+    },
 ];

package/dist/chat-threads/store.js

@@ -118,6 +118,20 @@ async function ensureTable() {
                 // scope) and sort by updated_at. Probe pg_indexes first (no lock)
                 // and skip the SHARE-locking CREATE INDEX when already present.
                 await ensureIndexExists("chat_threads_owner_updated_idx", `CREATE INDEX IF NOT EXISTS chat_threads_owner_updated_idx ON chat_threads (owner_email, updated_at)`);
+                // `owner_email` is stored as the user typed it, so access scoping
+                // compares `LOWER(owner_email)`. A plain btree on the raw column cannot
+                // serve that predicate — without the expression index the list falls
+                // back to scanning every row in the (shared, multi-tenant) table.
+                //
+                // NOT built CONCURRENTLY, despite the SHARE lock. This ensure path runs
+                // at release over the pooled Neon endpoint, and a transaction-pooled
+                // connection cannot carry `CREATE INDEX CONCURRENTLY` to completion:
+                // the statement returned without creating anything and the verifying
+                // probe failed the whole release, so no docs production deploy could
+                // publish. Release already runs locking DDL; a plain build here is the
+                // form that actually lands.
+                await ensureIndexExists("chat_threads_owner_lower_updated_idx", `CREATE INDEX IF NOT EXISTS chat_threads_owner_lower_updated_idx ON chat_threads (LOWER(owner_email), updated_at)`);
+                await ensureIndexExists("chat_thread_shares_principal_lower_idx", `CREATE INDEX IF NOT EXISTS chat_thread_shares_principal_lower_idx ON chat_thread_shares (resource_id, principal_type, LOWER(principal_id))`);
                 await ensureIndexExists("chat_threads_scope_updated_idx", `CREATE INDEX IF NOT EXISTS chat_threads_scope_updated_idx ON chat_threads (scope_type, scope_id, updated_at)`);
                 await ensureIndexExists("chat_threads_source_updated_idx", `CREATE INDEX IF NOT EXISTS chat_threads_source_updated_idx ON chat_threads (owner_email, source_app_id, updated_at)`);
                 // Public share-link resolution looks threads up by token hash;
@@ -175,6 +189,8 @@ async function ensureTable() {
             // idempotent across restarts.
             for (const ddl of [
                 `CREATE INDEX IF NOT EXISTS chat_threads_owner_updated_idx ON chat_threads (owner_email, updated_at)`,
+                `CREATE INDEX IF NOT EXISTS chat_threads_owner_lower_updated_idx ON chat_threads (LOWER(owner_email), updated_at)`,
+                `CREATE INDEX IF NOT EXISTS chat_thread_shares_principal_lower_idx ON chat_thread_shares (resource_id, principal_type, LOWER(principal_id))`,
                 `CREATE INDEX IF NOT EXISTS chat_threads_scope_updated_idx ON chat_threads (scope_type, scope_id, updated_at)`,
                 `CREATE INDEX IF NOT EXISTS chat_threads_source_updated_idx ON chat_threads (owner_email, source_app_id, updated_at)`,
                 `CREATE INDEX IF NOT EXISTS chat_threads_share_token_idx ON chat_threads (share_token_hash)`,
@@ -600,8 +616,11 @@ export async function listThreads(ownerEmail, options = {}, legacyOffset) {
     const offset = opts.offset ?? 0;
     const client = getDbExec();
     // `message_count > 0` is the authoritative "has messages" signal maintained
-    // on every write. The local-only view adds a narrowly scoped legacy marker
-    // check below because older integration rows predate persisted source fields.
+    // on every write. `source_platform` is the authoritative external-source
+    // signal: schema migration 3 backfilled the integration rows that predate the
+    // column, so nothing here may filter on `thread_data`. Matching that blob
+    // detoasts the whole message history for every scanned row — before LIMIT
+    // applies — which is what made this list cost seconds instead of milliseconds.
     const access = chatThreadAccessSql(ownerEmail, opts.orgId ?? getRequestOrgId());
     const filters = [access.sql, `message_count > 0`];
     const args = [...access.args];
@@ -610,7 +629,6 @@ export async function listThreads(ownerEmail, options = {}, legacyOffset) {
     }
     if (opts.includeExternal === false) {
         filters.push(`source_platform IS NULL`);
-        filters.push(`thread_data NOT LIKE '%"integrationDeliveryAttempted":true%'`);
         if (opts.sourceAppId) {
             filters.push(`(source_app_id IS NULL OR source_app_id = ?)`);
             args.push(opts.sourceAppId);
@@ -654,7 +672,6 @@ export async function searchThreads(ownerEmail, query, limit = 50, options = {})
     }
     if (options.includeExternal === false) {
         filters.push(`source_platform IS NULL`);
-        filters.push(`thread_data NOT LIKE '%"integrationDeliveryAttempted":true%'`);
         if (options.sourceAppId) {
             filters.push(`(source_app_id IS NULL OR source_app_id = ?)`);
             args.push(options.sourceAppId);

package/dist/cli/native-dependencies.d.ts

@@ -1,6 +1,10 @@
 type NativeDependencyCheck = {
     status: "absent";
     packageName: string;
+} | {
+    status: "stubbed";
+    packageName: string;
+    packageDir: string;
 } | {
     status: "healthy";
     packageName: string;

package/dist/cli/native-dependencies.js

@@ -57,6 +57,18 @@ function probeBetterSqlite3(packageDir) {
         return error;
     }
 }
+/**
+ * Whether this `better-sqlite3` is the build-time serverless stub rather than a
+ * real install. The stub's constructor throws by design, so probing it would
+ * report a broken native binding and send the CLI into a pointless rebuild.
+ */
+function isServerlessStub(packageDir) {
+    const manifestPath = path.join(packageDir, "package.json");
+    if (!fs.existsSync(manifestPath))
+        return false;
+    const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+    return manifest.agentNativeServerlessStub === true;
+}
 export function checkNativeDependencies(fromDirectory = corePackageDirectory()) {
     const packageDir = resolvePackageDirectory(BETTER_SQLITE3, fromDirectory) ??
         (path.resolve(fromDirectory) === corePackageDirectory()
@@ -65,6 +77,9 @@ export function checkNativeDependencies(fromDirectory = corePackageDirectory())
     if (!packageDir) {
         return { status: "absent", packageName: BETTER_SQLITE3 };
     }
+    if (isServerlessStub(packageDir)) {
+        return { status: "stubbed", packageName: BETTER_SQLITE3, packageDir };
+    }
     const error = probeBetterSqlite3(packageDir);
     return error === null
         ? { status: "healthy", packageName: BETTER_SQLITE3, packageDir }

package/dist/client/EnvironmentBadge.d.ts

@@ -1,5 +1,5 @@
 import type { AgentNativeDeploymentEnvironment, AgentNativeConfig } from "../config.js";
-export { BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, buildEnvironmentOptOutUrl, buildEnvironmentUrl, resolveEnvironmentTargets, type EnvironmentBadgeTargets, } from "../shared/environment-lanes.js";
+export { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, buildEnvironmentOptOutUrl, buildEnvironmentUrl, resolveEnvironmentTargets, type EnvironmentBadgeTargets, } from "../shared/environment-lanes.js";
 export declare function isBuilderIoEmployee(email: string | null | undefined): boolean;
 export declare function isAgentNativeDesktopUserAgent(userAgent: string | undefined): boolean;
 export declare function resolveEnvironmentChannel(config: AgentNativeConfig, hostname: string | undefined): Extract<AgentNativeDeploymentEnvironment, "local" | "beta" | "production"> | null;