@agent-native/core 0.203.2-nightly-20261007213109 → 0.204.0

package/dist/server/agent-chat/script-entries.js

@@ -1,5 +1,6 @@
 import { renameThread, resolveThreadAccess, setThreadArchived, setThreadPinned, } from "../../chat-threads/store.js";
 import { dbExecToolParameters } from "../../scripts/db/tool-schemas.js";
+import { serializeCliArgs } from "../../scripts/parse-args.js";
 import { captureCliOutput } from "../cli-capture.js";
 import { getAmbientUserEmail, getRequestOrgId, getRequestRunContext, getRequestUserEmail, } from "../request-context.js";
 function wrapCliScript(tool, cliDefault, opts) {
@@ -7,18 +8,12 @@ function wrapCliScript(tool, cliDefault, opts) {
         tool,
         ...(opts?.readOnly ? { readOnly: true } : {}),
         run: async (args) => {
-            const cliArgs = [];
-            for (const [k, v] of Object.entries(args)) {
+            for (const k of Object.keys(args)) {
                 if (opts?.allowedArgs && !opts.allowedArgs.includes(k)) {
                     throw new Error(`Unknown argument: ${k}`);
                 }
-                const raw = v;
-                const value = raw != null && typeof raw === "object"
-                    ? JSON.stringify(raw)
-                    : String(raw);
-                cliArgs.push(`--${k}`, value);
             }
-            return captureCliOutput(() => cliDefault(cliArgs));
+            return captureCliOutput(() => cliDefault(serializeCliArgs(args)));
         },
     };
 }

package/dist/server/agent-chat-plugin.js

@@ -46,6 +46,7 @@ import { setProgressPreListHook } from "../progress/store.js";
 import { getSkillNameFromPath } from "../resources/metadata.js";
 import { resourceList, resourceListAccessible, resourceGet, ensurePersonalDefaults, isWorkspaceResourceOwner, SHARED_OWNER, WORKSPACE_OWNER, } from "../resources/store.js";
 import { normalizeDatabaseToolsMode } from "../scripts/db/tool-mode.js";
+import { normalizeShellArgs, serializeCliArgs } from "../scripts/parse-args.js";
 import { getSetting, putSetting } from "../settings/store.js";
 import { retryContextFromRequest, } from "../shared/agent-chat-run-not-started.js";
 import { ANALYTICS_CLIENT_PLATFORM_BODY_FIELD, normalizeAnalyticsClientPlatform, } from "../shared/analytics-platform.js";
@@ -1043,54 +1044,19 @@ export function createAgentChatPlugin(options) {
                                     }
                                     const tokens = [];
                                     if (typeof input?.args === "string" && input.args.trim()) {
-                                        let current = "";
-                                        let inSingle = false;
-                                        let inDouble = false;
-                                        let escape = false;
-                                        for (let i = 0; i < input.args.length; i++) {
-                                            const char = input.args[i];
-                                            if (escape) {
-                                                current += char;
-                                                escape = false;
-                                                continue;
-                                            }
-                                            if (char === "\\") {
-                                                if (inSingle) {
-                                                    current += char;
-                                                }
-                                                else {
-                                                    escape = true;
-                                                }
-                                                continue;
-                                            }
-                                            if (char === "'" && !inDouble) {
-                                                inSingle = !inSingle;
-                                                continue;
-                                            }
-                                            if (char === '"' && !inSingle) {
-                                                inDouble = !inDouble;
-                                                continue;
-                                            }
-                                            if (/\s/.test(char) && !inSingle && !inDouble) {
-                                                if (current.length > 0) {
-                                                    tokens.push(current);
-                                                    current = "";
-                                                }
-                                                continue;
-                                            }
-                                            current += char;
-                                        }
-                                        if (current.length > 0) {
-                                            tokens.push(current);
-                                        }
+                                        tokens.push(...normalizeShellArgs(input.args, {
+                                            backslashEscapes: true,
+                                            splitAllWhitespace: true,
+                                        }));
                                     }
                                     else if (input && typeof input === "object") {
+                                        const actionArgs = {};
                                         for (const [k, v] of Object.entries(input)) {
                                             if (k === "args" || v === undefined || v === null)
                                                 continue;
-                                            const strVal = typeof v === "object" ? JSON.stringify(v) : String(v);
-                                            tokens.push(`--${k}`, strVal);
+                                            actionArgs[k] = v;
                                         }
+                                        tokens.push(...serializeCliArgs(actionArgs));
                                     }
                                     const BLOCKED_OPERATORS = new Set([
                                         ";",

package/dist/server/agent-engine-default-model-route.d.ts

@@ -9,16 +9,16 @@ export declare const AGENT_ENGINE_API_KEY_ACTION_NAME = "agent-engine-api-key";
  */
 export declare function createAgentEngineDisconnectHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     scope?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     error: any;
     scope?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     scope: "org" | "user";
+    error?: undefined;
 }>>;
 export interface DefaultModelSelectionRequest {
     engine: string;

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -1,6 +1,6 @@
 export declare function createAgentEngineOllamaModelsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
     models?: undefined;
 } | {
     error?: undefined;

package/dist/server/auth.js

@@ -85,6 +85,7 @@ import * as loopback from "./loopback.js";
 import { encodeMagicLinkSignupAttribution, MAGIC_LINK_ATTRIBUTION_PARAM, } from "./magic-link-attribution.js";
 import { safeOAuthReturnUrl } from "./oauth-return-url.js";
 import { getDeploySettingsRequiredHtml, getOnboardingHtml, getResetPasswordHtml, } from "./onboarding-html.js";
+import { queryEchoSafeRedirect } from "./query-echo-safe-redirect.js";
 import { getRequestContext, markRequestIdentityAuthenticatedAtMs, hasContinuationLocalRequestContext, hasExplicitPersonalOrgScope, markExplicitPersonalOrgScope, runWithRequestContext, } from "./request-context.js";
 import { captureAuthError } from "./sentry.js";
 import { isTestIdentity } from "./test-identity.js";
@@ -4901,7 +4902,9 @@ async function mountBetterAuthRoutes(app, options) {
             response.status < 300) {
             setFirstRunOnboardingCookie(event);
         }
-        return response;
+        return isResponse
+            ? queryEchoSafeRedirect(event, response)
+            : response;
     }));
     app.use("/_agent-native/auth/login", defineEventHandler(async (event) => {
         if (getMethod(event) !== "POST") {
@@ -4968,7 +4971,7 @@ async function mountBetterAuthRoutes(app, options) {
             ? query.return[0]
             : query.return;
         setFirstRunOnboardingCookie(event);
-        return redirectWithStagedCookies(event, safeReturnPath(rawReturn), 302);
+        return queryEchoSafeRedirect(event, redirectWithStagedCookies(event, safeReturnPath(rawReturn), 302));
     }));
     app.use("/_agent-native/auth/magic-link", defineEventHandler(async (event) => {
         if (getMethod(event) === "POST" &&

package/dist/server/core-routes-plugin.js

@@ -4152,12 +4152,31 @@ export function createCoreRoutesPlugin(options = {}) {
                     return { error: "Unauthorized" };
                 }
                 const userEmail = session.email;
-                const result = await runWithRequestContext({ userEmail, orgId: session.orgId }, () => uploadFile({
-                    data: filePart.data,
-                    filename: filePart.filename,
-                    mimeType: filePart.type,
-                    ownerEmail: userEmail,
-                }));
+                let result;
+                try {
+                    result = await runWithRequestContext({ userEmail, orgId: session.orgId }, () => uploadFile({
+                        data: filePart.data,
+                        filename: filePart.filename,
+                        mimeType: filePart.type,
+                        ownerEmail: userEmail,
+                    }));
+                }
+                catch (error) {
+                    // A thrown provider error (e.g. an upstream API rejecting the
+                    // request) carries its own `status`/`statusCode`, which h3 would
+                    // otherwise surface verbatim to the client — indistinguishable
+                    // from this route's own deliberate 4xx responses above and
+                    // useless for the composer's generic "could not upload" copy.
+                    // Normalize to one clear failure instead of leaking whatever
+                    // status the active provider happened to respond with. Use 503
+                    // (not 502/504) since gateway statuses get rewritten by the CDN
+                    // layer anyway — see cdnSafeOriginStatus.
+                    console.error("[file-upload] provider upload failed", error);
+                    setResponseStatus(event, 503);
+                    return {
+                        error: "The configured storage provider could not upload this file. Try again or check Settings → File uploads.",
+                    };
+                }
                 if (result) {
                     setResponseStatus(event, 201);
                     return result;

package/dist/server/google-oauth.js

@@ -14,6 +14,7 @@ import { setIdentityGoogleAuthCookie } from "./identity-auth-provider.js";
 import { isNetlifyDeployPermalinkGoogleOAuthClientOrigin, isNetlifyDeployPermalinkGoogleOAuthClientRequest, } from "./identity-sso-store.js";
 import { appendSessionToOAuthReturnUrl } from "./oauth-return-url.js";
 import { EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS, firstOriginFromEnv, getConfiguredOriginAllowlist, isLoopbackHost, normalizeOrigin, WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS, } from "./origin-allowlist.js";
+import { queryEchoSafeRedirect } from "./query-echo-safe-redirect.js";
 import { isWorkspaceOAuthCallbackRelayEnabled } from "./workspace-oauth.js";
 function safeReturnPath(raw) {
     return normalizeAppPath(raw) ?? "/";
@@ -669,9 +670,6 @@ export function oauthCallbackResponse(event, email, opts) {
       </script></body></html>`);
     }
     const location = appendSessionToOAuthReturnUrl(opts.returnUrl, opts.sessionToken);
-    setResponseStatus(event, 302);
-    setResponseHeader(event, "Location", location);
-    setResponseHeader(event, "Referrer-Policy", "no-referrer");
     const headers = new Headers({
         Location: location,
         "Referrer-Policy": "no-referrer",
@@ -679,7 +677,13 @@ export function oauthCallbackResponse(event, email, opts) {
     for (const cookie of event.res?.headers?.getSetCookie?.() ?? []) {
         headers.append("set-cookie", cookie);
     }
-    return new Response(null, { status: 302, headers });
+    const response = queryEchoSafeRedirect(event, new Response(null, { status: 302, headers }));
+    if (response.status === 302) {
+        setResponseStatus(event, 302);
+        setResponseHeader(event, "Location", location);
+    }
+    setResponseHeader(event, "Referrer-Policy", "no-referrer");
+    return response;
 }
 export function oauthErrorPage(message, status = 400) {
     const safe = escapeHtml(message);

package/dist/server/identity-sso.js

@@ -16,6 +16,7 @@ import { createOAuthSession, getAppUrl, getOrigin } from "./google-oauth.js";
 import { hasIdentityGoogleAuthCookie } from "./identity-auth-provider.js";
 import { IDENTITY_SSO_PROVIDER_ID } from "./identity-sso-provider.js";
 import { consumeSsoState, createSsoState, CANONICAL_IDENTITY_SSO_HUB_URL, NETLIFY_PREVIEW_IDENTITY_SSO_HUB_URL, getIdentityHubUrl, identitySsoLoginButtonHtml, isCanonicalIdentitySsoClientRequest, isDesktopSsoUserAgent, isIdentitySsoExplicitlyEnabled, isIdentitySsoEnabled, isNetlifyDeployPermalinkIdentitySsoClientRequest, isJtiReplayed, SSO_STATE_TTL_MS, } from "./identity-sso-store.js";
+import { queryEchoSafeRedirect } from "./query-echo-safe-redirect.js";
 import { getRequestContext, hasContinuationLocalRequestContext, runWithRequestContext, } from "./request-context.js";
 export { getIdentityHubUrl, identitySsoLoginButtonHtml, isIdentitySsoEnabled };
 export { IDENTITY_SSO_PROVIDER_ID };
@@ -63,7 +64,7 @@ function redirect(event, location) {
     const staged = event.res?.headers?.getSetCookie?.() ?? [];
     for (const cookie of staged)
         headers.append("set-cookie", cookie);
-    return new Response("", { status: 302, headers });
+    return queryEchoSafeRedirect(event, new Response("", { status: 302, headers }));
 }
 function errorPage(message, loginPath) {
     const safe = message

package/dist/server/index.d.ts

@@ -86,6 +86,7 @@ export { createOnboardingPlugin, defaultOnboardingPlugin, } from "../onboarding/
 export { registerFileUploadProvider, unregisterFileUploadProvider, listFileUploadProviders, getActiveFileUploadProvider, getActiveFileUploadProviderForRequest, uploadFile, builderFileUploadProvider, type FileUploadInput, type FileUploadProvider, type FileUploadResult, } from "../file-upload/index.js";
 export { createIntegrationsPlugin, defaultIntegrationsPlugin, enqueueRemoteCommand, slackAdapter, telegramAdapter, whatsappAdapter, discordAdapter, microsoftTeamsAdapter, emailAdapter, assertPlatformCapability, type PlatformAdapter, type IncomingMessage, type OutgoingMessage, type PlatformAdapterCapabilities, type ImmediateWebhookResponse, type IntegrationStatus, type IntegrationsPluginOptions, type IntegrationExecutionContext, BUILT_IN_INTEGRATION_CATALOG, INTEGRATION_CATEGORIES, getIntegrationCatalogEntry, listBuiltInChannelIntegrations, listIntegrationCatalog, type BuiltInChannelId, type ChannelCapabilities, type IntegrationAvailability, type IntegrationCatalogEntry, type IntegrationCategory, type IntegrationCredentialRequirement, type IntegrationIconKey, type IntegrationSupportMaturity, } from "../integrations/index.js";
 export { isElectron, isMobile, getOrigin, getAppBasePath, getAppUrl, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, encodeOAuthState, decodeOAuthState, encodeNetlifyPreviewGoogleOAuthRelayState, decodeNetlifyPreviewGoogleOAuthRelayState, wrapNetlifyPreviewGoogleOAuthState, getNetlifyPreviewGoogleOAuthCallbackUrl, isNetlifyPreviewGoogleOAuthCallbackUrl, isNetlifyPreviewGoogleOAuthRelayState, AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET_ENV, NETLIFY_PREVIEW_GOOGLE_OAUTH_CALLBACK_URL, logOAuthStateDecodeFailure, resolveOAuthOwner, createOAuthSession, oauthCallbackResponse, oauthErrorPage, oauthDesktopExchangePage, type OAuthStatePayload, type OAuthStateDecodeFailureReason, type DecodeOAuthStateResult, type OAuthOwnerResult, type OAuthSessionResult, } from "./google-oauth.js";
+export { queryEchoSafeRedirect } from "./query-echo-safe-redirect.js";
 export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, hasWorkspaceProviderOAuthCredentials, isGoogleWorkspaceOAuthProvider, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, type GenericWorkspaceOAuthProvider, type WorkspaceProviderOAuthFlow, } from "./workspace-provider-oauth.js";
 export { CredentialStoreUnavailableError, FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderEmbeddingsBaseUrl, getBuilderVideoGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, resolveBuilderGatewayCredentialsDetailed, resolveBuilderGatewayAuth, resolveBuilderGatewayCredentials, resolveHasBuilderGatewayCredential, resolveBuilderCredentialSource, resolveBuilderCredential, readDeployCredentialEnv, resolveVercelDeploymentProtectionHeaders, writeBuilderCredentials, deleteBuilderCredentials, resolveSecret, resolveSecretDetailed, prefetchSecrets, BuilderCredentialLookupError, type BuilderCredentialsDetailed, type ResolvedSecretDetail, } from "./credential-provider.js";
 export { GEMINI_API_KEY, LEGACY_GEMINI_API_KEY, canonicalSecretKey, readGeminiDeployCredentialEnv, resolveGeminiApiKey, resolveGeminiApiKeyDetailed, resolveSecretWithAliases, resolveSecretWithAliasesDetailed, secretKeyNames, type ResolvedAliasedSecret, } from "./secret-key-aliases.js";

package/dist/server/index.js

@@ -81,6 +81,7 @@ export { createOnboardingPlugin, defaultOnboardingPlugin, } from "../onboarding/
 export { registerFileUploadProvider, unregisterFileUploadProvider, listFileUploadProviders, getActiveFileUploadProvider, getActiveFileUploadProviderForRequest, uploadFile, builderFileUploadProvider, } from "../file-upload/index.js";
 export { createIntegrationsPlugin, defaultIntegrationsPlugin, enqueueRemoteCommand, slackAdapter, telegramAdapter, whatsappAdapter, discordAdapter, microsoftTeamsAdapter, emailAdapter, assertPlatformCapability, BUILT_IN_INTEGRATION_CATALOG, INTEGRATION_CATEGORIES, getIntegrationCatalogEntry, listBuiltInChannelIntegrations, listIntegrationCatalog, } from "../integrations/index.js";
 export { isElectron, isMobile, getOrigin, getAppBasePath, getAppUrl, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, encodeOAuthState, decodeOAuthState, encodeNetlifyPreviewGoogleOAuthRelayState, decodeNetlifyPreviewGoogleOAuthRelayState, wrapNetlifyPreviewGoogleOAuthState, getNetlifyPreviewGoogleOAuthCallbackUrl, isNetlifyPreviewGoogleOAuthCallbackUrl, isNetlifyPreviewGoogleOAuthRelayState, AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET_ENV, NETLIFY_PREVIEW_GOOGLE_OAUTH_CALLBACK_URL, logOAuthStateDecodeFailure, resolveOAuthOwner, createOAuthSession, oauthCallbackResponse, oauthErrorPage, oauthDesktopExchangePage, } from "./google-oauth.js";
+export { queryEchoSafeRedirect } from "./query-echo-safe-redirect.js";
 export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, hasWorkspaceProviderOAuthCredentials, isGoogleWorkspaceOAuthProvider, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, } from "./workspace-provider-oauth.js";
 export { CredentialStoreUnavailableError, FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderEmbeddingsBaseUrl, getBuilderVideoGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, resolveBuilderGatewayCredentialsDetailed, resolveBuilderGatewayAuth, resolveBuilderGatewayCredentials, resolveHasBuilderGatewayCredential, resolveBuilderCredentialSource, resolveBuilderCredential, readDeployCredentialEnv, resolveVercelDeploymentProtectionHeaders, writeBuilderCredentials, deleteBuilderCredentials, resolveSecret, resolveSecretDetailed, prefetchSecrets, BuilderCredentialLookupError, } from "./credential-provider.js";
 export { GEMINI_API_KEY, LEGACY_GEMINI_API_KEY, canonicalSecretKey, readGeminiDeployCredentialEnv, resolveGeminiApiKey, resolveGeminiApiKeyDetailed, resolveSecretWithAliases, resolveSecretWithAliasesDetailed, secretKeyNames, } from "./secret-key-aliases.js";

package/dist/server/poll.d.ts

@@ -86,6 +86,10 @@ export declare class AppSyncState {
     private accessCacheTtl;
     private durableEventId;
     getVersion(): number;
+    getPollBaseline(useDurableEvents: boolean): Promise<{
+        version: number;
+        cursor: string;
+    }>;
     getPollEmitter(): EventEmitter;
     wireLocalEmitters(): void;
     ensureSyncEventsTable(): Promise<boolean>;
@@ -154,6 +158,7 @@ export declare class AppSyncState {
     getChangesSinceForUser(since: number, userEmail: string, orgId: string | undefined, cursor?: SyncCursor): ChangeReadResult;
     getDurableChangesSinceForUser(since: number, userEmail: string, orgId: string | undefined, cursor?: SyncCursor): Promise<ChangeReadResult>;
     getCombinedChangesSinceForUser(since: number, userEmail: string, orgId: string | undefined, useDurableEvents: boolean, cursor?: SyncCursor): Promise<ChangeReadResult>;
+    private readCombinedChangesSinceForUser;
     seedVersionFromDb(): Promise<void>;
     checkExternalDbChanges(options: {
         durableEvents: boolean;
@@ -164,6 +169,10 @@ declare function hostedRealtimeTransportEnabled(): boolean;
 export declare const __hostedRealtimeTransportEnabledForTests: typeof hostedRealtimeTransportEnabled;
 export declare function getDefaultAppSyncState(): AppSyncState;
 export declare function getVersion(): number;
+export declare function getCurrentPollBaseline(state?: AppSyncState): Promise<{
+    version: number;
+    cursor: string;
+}>;
 export declare function getPollEmitter(): EventEmitter;
 export declare function invalidateCollabAccessCache(resourceType: string, resourceId: string): void;
 export declare function __resetCollabAccessCacheForTests(): void;

package/dist/server/poll.js

@@ -43,6 +43,7 @@ export const POLL_CHANGE_EVENT = "poll-change";
 const ACCESS_CACHE_TTL_MS = 30_000;
 const ACCESS_CACHE_DENY_TTL_MS = 5_000;
 const ACCESS_CACHE_MAX = 500;
+const ACCESS_CHECK_WAIT_MS = 1_000;
 const SCREEN_REFRESH_KEY = "__screen_refresh__";
 const SCREEN_REFRESH_QUERY_LIMIT = 256;
 const SEED_SYNC_VERSION_SQL = `
@@ -278,7 +279,7 @@ export class AppSyncState {
     screenRefreshHasMore = false;
     localEmittersWired = false;
     accessCache = new Map();
-    accessInFlight = new Set();
+    accessInFlight = new Map();
     accessInvalidationEpoch = new Map();
     accessAllowTtlMs;
     constructor(options = {}) {
@@ -311,6 +312,40 @@ export class AppSyncState {
     getVersion() {
         return this.version;
     }
+    async getPollBaseline(useDurableEvents) {
+        let cursor = { version: this.version, id: "" };
+        if (compareSyncCursors(this.latestCursor, cursor) > 0) {
+            cursor = this.latestCursor;
+        }
+        if (useDurableEvents && !syncEventsDisabled()) {
+            try {
+                const result = await this.getDb().execute("SELECT version, id FROM sync_events WHERE version = (SELECT MAX(version) FROM sync_events) ORDER BY id DESC LIMIT 1");
+                const row = result.rows[0];
+                if (row) {
+                    const version = Number(row.version);
+                    if (!Number.isSafeInteger(version) ||
+                        version < 0 ||
+                        typeof row.id !== "string") {
+                        throw new Error("Durable sync event cursor is invalid");
+                    }
+                    const durableCursor = { version, id: row.id };
+                    if (compareSyncCursors(durableCursor, cursor) > 0) {
+                        cursor = durableCursor;
+                    }
+                }
+            }
+            catch (error) {
+                if (isMissingRelationError(error)) {
+                    throw new SyncEventsTableUnavailableError();
+                }
+                throw error;
+            }
+        }
+        return {
+            version: Math.max(this.version, cursor.version),
+            cursor: encodeSyncCursor(cursor),
+        };
+    }
     getPollEmitter() {
         return this.pollEmitter;
     }
@@ -551,7 +586,7 @@ export class AppSyncState {
             if (key.endsWith(suffix))
                 this.accessCache.delete(key);
         }
-        for (const key of Array.from(this.accessInFlight)) {
+        for (const key of Array.from(this.accessInFlight.keys())) {
             if (key.endsWith(suffix))
                 this.accessInFlight.delete(key);
         }
@@ -572,10 +607,10 @@ export class AppSyncState {
     scheduleAccessCheck(key, resourceType, resourceId, userEmail, orgId) {
         if (this.accessInFlight.has(key))
             return;
-        this.accessInFlight.add(key);
         const resourceKey = accessResourceKey(resourceType, resourceId);
         const epoch = this.accessInvalidationEpoch.get(resourceKey) ?? 0;
-        void (async () => {
+        let settled = false;
+        const check = (async () => {
             try {
                 const access = await this.resolveAccessFn(resourceType, resourceId, {
                     userEmail,
@@ -593,9 +628,12 @@ export class AppSyncState {
                 this.setAccessCache(key, false, Date.now());
             }
             finally {
+                settled = true;
                 this.accessInFlight.delete(key);
             }
         })();
+        if (!settled)
+            this.accessInFlight.set(key, check);
     }
     __resetAccessCacheForTests() {
         this.accessCache.clear();
@@ -896,7 +934,7 @@ export class AppSyncState {
             return { version: this.version, events: [] };
         }
         const readCursor = cursor ?? { version: since, id: "" };
-        if (readCursor.version <= 0 && readCursor.id === "") {
+        if (!cursor && readCursor.version <= 0 && readCursor.id === "") {
             try {
                 const result = await this.getDb().execute("SELECT MAX(version) as max_version FROM sync_events");
                 return {
@@ -1044,6 +1082,23 @@ export class AppSyncState {
         }
     }
     async getCombinedChangesSinceForUser(since, userEmail, orgId, useDurableEvents, cursor) {
+        const result = await this.readCombinedChangesSinceForUser(since, userEmail, orgId, useDurableEvents, cursor);
+        if (!result.cursorLimited || this.accessInFlight.size === 0)
+            return result;
+        // A read stopped at an event whose access check had not finished. The
+        // check is already running, so waiting for it here (bounded) delivers the
+        // event now instead of one poll interval later.
+        let timer;
+        await Promise.race([
+            Promise.allSettled(this.accessInFlight.values()),
+            new Promise((resolve) => {
+                timer = setTimeout(resolve, ACCESS_CHECK_WAIT_MS);
+            }),
+        ]);
+        clearTimeout(timer);
+        return this.readCombinedChangesSinceForUser(since, userEmail, orgId, useDurableEvents, cursor);
+    }
+    async readCombinedChangesSinceForUser(since, userEmail, orgId, useDurableEvents, cursor) {
         const memory = this.getChangesSinceForUser(since, userEmail, orgId, cursor);
         if (!useDurableEvents)
             return memory;
@@ -1066,8 +1121,7 @@ export class AppSyncState {
         if (cursor) {
             const limitedCursors = [memory, durable]
                 .filter((result) => result.cursorLimited)
-                .map((result) => decodeSyncCursor(result.cursor))
-                .filter((value) => !!value);
+                .map((result) => decodeSyncCursor(result.cursor) ?? cursor);
             if (limitedCursors.length > 0) {
                 const boundary = limitedCursors.reduce((minimum, value) => compareSyncCursors(value, minimum) < 0 ? value : minimum);
                 return {
@@ -1103,6 +1157,7 @@ export class AppSyncState {
             events: limitedVersions.length > 0
                 ? events.filter((event) => event.version <= Math.min(...limitedVersions))
                 : events,
+            ...(limitedVersions.length > 0 ? { cursorLimited: true } : {}),
         };
     }
     async seedVersionFromDb() {
@@ -1356,6 +1411,30 @@ export function getDefaultAppSyncState() {
 export function getVersion() {
     return getDefaultAppSyncState().getVersion();
 }
+export async function getCurrentPollBaseline(state = getDefaultAppSyncState()) {
+    if (syncEventsDisabled()) {
+        await state.seedVersionFromDb();
+        await state.checkExternalDbChanges({ durableEvents: false });
+        return state.getPollBaseline(false);
+    }
+    const releaseOwnedServerlessPoll = isProductionServerlessFunctionRuntime() && appMigratesAtRelease();
+    try {
+        if (!releaseOwnedServerlessPoll) {
+            await state.seedVersionFromDb();
+            await state.checkExternalDbChanges({ durableEvents: true });
+        }
+        return await state.getPollBaseline(true);
+    }
+    catch (error) {
+        if (!(error instanceof SyncEventsTableUnavailableError))
+            throw error;
+        if (releaseOwnedServerlessPoll)
+            throw error;
+        await state.seedVersionFromDb();
+        await state.checkExternalDbChanges({ durableEvents: false });
+        return state.getPollBaseline(false);
+    }
+}
 export function getPollEmitter() {
     return getDefaultAppSyncState().getPollEmitter();
 }

package/dist/server/query-echo-safe-redirect.d.ts

@@ -0,0 +1,10 @@
+import type { H3Event } from "h3";
+/**
+ * Netlify's proxy copies the request's query string onto any redirect whose
+ * Location has none, so a bare 302 out of a sign-in callback lands the browser
+ * on a page still carrying the one-time `token`, OAuth `code`, or attribution
+ * params. Every later bare 302 in the chain inherits the query the same way,
+ * so no redirect-only route can shed it. Netlify leaves a 200 alone: a
+ * navigation gets an HTML page that replaces itself with the clean Location.
+ */
+export declare function queryEchoSafeRedirect(event: H3Event, response: Response): Response;

package/dist/server/query-echo-safe-redirect.js

@@ -0,0 +1,102 @@
+import { getHeader } from "h3";
+import { getAppBasePathFromViteEnv } from "./app-base-path.js";
+function requestHasQuery(event) {
+    if (event.url?.search)
+        return true;
+    const raw = event.node?.req?.url ??
+        (typeof event.path === "string" ? event.path : "");
+    const queryStart = raw.indexOf("?");
+    return queryStart >= 0 && queryStart < raw.length - 1;
+}
+function isDocumentNavigation(event) {
+    const mode = getHeader(event, "sec-fetch-mode");
+    if (mode)
+        return mode === "navigate";
+    return (getHeader(event, "accept") ?? "").includes("text/html");
+}
+const PATH_BASE = "http://an.invalid";
+// The page navigates with `location.replace`, which runs a `javascript:` URL
+// that a 302 would refuse, so only http(s) destinations qualify. A path is
+// resolved rather than pattern-matched: the URL parser drops tabs and
+// newlines, so `/\t/evil.test` names another host.
+function bareHttpDestination(location) {
+    try {
+        if (location.startsWith("/")) {
+            const target = new URL(location, PATH_BASE);
+            if (target.origin !== PATH_BASE || target.search)
+                return null;
+            return withAppBasePath(location);
+        }
+        const target = new URL(location);
+        if (target.protocol !== "https:" && target.protocol !== "http:") {
+            return null;
+        }
+        return target.search ? null : location;
+        // coercion-ok: a Location the URL parser rejects is not ours to rewrite.
+    }
+    catch {
+        return null;
+    }
+}
+// Workspace mounts and the dev gateway prefix an app's path Locations with its
+// base path, but only on 3xx responses; the page has to carry the prefix.
+function withAppBasePath(path) {
+    const base = getAppBasePathFromViteEnv();
+    if (!base)
+        return path;
+    const pathname = path.split(/[?#]/, 1)[0] || path;
+    if (pathname === base ||
+        pathname === `${base}.data` ||
+        pathname.startsWith(`${base}/`)) {
+        return path;
+    }
+    return pathname === "/" ? `${base}${path.slice(1)}` : `${base}${path}`;
+}
+function escapeHtmlAttr(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+/**
+ * Netlify's proxy copies the request's query string onto any redirect whose
+ * Location has none, so a bare 302 out of a sign-in callback lands the browser
+ * on a page still carrying the one-time `token`, OAuth `code`, or attribution
+ * params. Every later bare 302 in the chain inherits the query the same way,
+ * so no redirect-only route can shed it. Netlify leaves a 200 alone: a
+ * navigation gets an HTML page that replaces itself with the clean Location.
+ */
+export function queryEchoSafeRedirect(event, response) {
+    // 307 and 308 replay the request method; a page that navigates would turn a
+    // POST into a GET.
+    if (![301, 302, 303].includes(response.status))
+        return response;
+    const location = response.headers.get("location");
+    if (!location || !requestHasQuery(event) || !isDocumentNavigation(event)) {
+        return response;
+    }
+    const destination = bareHttpDestination(location);
+    if (!destination)
+        return response;
+    const headers = new Headers();
+    for (const [key, value] of response.headers.entries()) {
+        const name = key.toLowerCase();
+        if (name === "location" ||
+            name === "set-cookie" ||
+            name === "content-length" ||
+            name === "content-type") {
+            continue;
+        }
+        headers.append(key, value);
+    }
+    for (const cookie of response.headers.getSetCookie()) {
+        headers.append("set-cookie", cookie);
+    }
+    headers.set("cache-control", "no-store");
+    headers.set("content-type", "text/html; charset=utf-8");
+    headers.set("referrer-policy", "no-referrer");
+    const href = escapeHtmlAttr(destination);
+    const script = JSON.stringify(destination).replace(/</g, "\\u003c");
+    return new Response(`<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="referrer" content="no-referrer"><meta http-equiv="refresh" content="0;url=${href}"><script>location.replace(${script})</script></head><body></body></html>`, { status: 200, headers });
+}

package/dist/server/release-schema.js

@@ -261,6 +261,10 @@ const FRAMEWORK_SCHEMA_ENSURES = [
         "SearchIndex",
         () => import("../search/index-store.js").then((m) => m.ensureSearchIndexTables()),
     ],
+    [
+        "ServicePrincipalPolicies",
+        () => import("../org/service-principal-policy.js").then((m) => m.ensureTable()),
+    ],
     [
         "Settings",
         () => import("../settings/store.js").then((m) => m.ensureTable()),

package/dist/server/workspace-provider-oauth.js

@@ -11,6 +11,7 @@ import { getSession, redirectWithStagedCookies, safeReturnPath, } from "./auth.j
 import { resolveSecret } from "./credential-provider.js";
 import { canonicalFrameworkPathname } from "./framework-route-prefix.js";
 import { decodeOAuthState, encodeOAuthState, getAppUrl, logOAuthStateDecodeFailure, oauthErrorPage, resolveOAuthRedirectUri, } from "./google-oauth.js";
+import { queryEchoSafeRedirect } from "./query-echo-safe-redirect.js";
 import { runWithRequestContext } from "./request-context.js";
 const SUPPORTED_PROVIDERS = new Set([
     "figma",
@@ -342,7 +343,7 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
         const returnPath = flow.returnUrl ??
             state.returnUrl ??
             `/settings/integrations?connected=${encodeURIComponent(providerId)}`;
-        return redirectWithStagedCookies(event, getAppUrl(event, returnPath));
+        return queryEchoSafeRedirect(event, redirectWithStagedCookies(event, getAppUrl(event, returnPath)));
     });
 }
 export function buildWorkspaceProviderAuthorizationUrl(input) {

package/dist/templates/chat/.agents/skills/actions/references/action-fields.md

@@ -16,6 +16,7 @@ Rules:
 - To override the inference on an unusual action (e.g. a `POST` that only reads), pass `readOnly: true` on the action definition.
 - To let a mutating action run concurrently with other same-turn tool calls, pass `parallelSafe: true`. Only do this when the action is internally concurrency-safe and order-independent (for example, it uses an app-level lock or idempotent upsert semantics). Mutating actions remain serialized by default.
 - If a successful call hands control to the user — it renders a question, an intake form, or anything else the turn must wait on — pass `endsTurn: true` and make it the first or only call in the turn. It stops subsequent model steps and later calls, but cannot undo calls emitted before it. Without it a completion guard sees a turn that legitimately paused as one that failed to finish. `endsTurn: true` also hides the action from MCP, WebMCP, and A2A callers by default (`isActionExposedToExternalAgents` in core `action.ts`) — an external host has no in-app chat to receive the answer on. Pass `mcpTool: true` alongside it only when an external caller can complete the same operation without that answer.
+- MCP hosts read tool annotations to decide how carefully to treat a call. Every MCP catalog advertises declared `mcpAnnotations` (`readOnlyHint`, `destructiveHint`, `openWorldHint`, optional `idempotentHint`); otherwise `/mcp` derives only `readOnlyHint` and an approval-based `destructiveHint`. Declare them on any external write that removes, overwrites, or replaces user content — recoverable Trash included — and mark idempotency-key-guarded writes `idempotentHint: true`.
 
 Agents do NOT need to call `refresh-screen` after a normal action — it's already handled. `refresh-screen` is only needed when the agent mutates data via a path the framework can't see (e.g. writing to an external system the app mirrors) or when the agent wants to pass a `scope` hint for narrower invalidation.
 

package/dist/templates/default/.agents/skills/actions/references/action-fields.md

@@ -16,6 +16,7 @@ Rules:
 - To override the inference on an unusual action (e.g. a `POST` that only reads), pass `readOnly: true` on the action definition.
 - To let a mutating action run concurrently with other same-turn tool calls, pass `parallelSafe: true`. Only do this when the action is internally concurrency-safe and order-independent (for example, it uses an app-level lock or idempotent upsert semantics). Mutating actions remain serialized by default.
 - If a successful call hands control to the user — it renders a question, an intake form, or anything else the turn must wait on — pass `endsTurn: true` and make it the first or only call in the turn. It stops subsequent model steps and later calls, but cannot undo calls emitted before it. Without it a completion guard sees a turn that legitimately paused as one that failed to finish. `endsTurn: true` also hides the action from MCP, WebMCP, and A2A callers by default (`isActionExposedToExternalAgents` in core `action.ts`) — an external host has no in-app chat to receive the answer on. Pass `mcpTool: true` alongside it only when an external caller can complete the same operation without that answer.
+- MCP hosts read tool annotations to decide how carefully to treat a call. Every MCP catalog advertises declared `mcpAnnotations` (`readOnlyHint`, `destructiveHint`, `openWorldHint`, optional `idempotentHint`); otherwise `/mcp` derives only `readOnlyHint` and an approval-based `destructiveHint`. Declare them on any external write that removes, overwrites, or replaces user content — recoverable Trash included — and mark idempotency-key-guarded writes `idempotentHint: true`.
 
 Agents do NOT need to call `refresh-screen` after a normal action — it's already handled. `refresh-screen` is only needed when the agent mutates data via a path the framework can't see (e.g. writing to an external system the app mirrors) or when the agent wants to pass a `scope` hint for narrower invalidation.