@agent-native/core 0.205.0 → 0.206.0-nightly-20261009011246

package/dist/server/request-context.d.ts

@@ -58,6 +58,11 @@ export interface RequestContext {
     userEmail?: string;
     /** Keep data-source credentials within the selected org, not the user. */
     credentialScope?: "org";
+    /** Provenance set only after a stored org service token is verified. */
+    verifiedServiceIdentity?: {
+        userEmail: string;
+        orgId: string;
+    };
     identityAuthenticatedAtMs?: number;
     identitySessionToken?: string;
     authUserId?: string;
@@ -129,6 +134,17 @@ export interface RequestContext {
     };
     run?: RequestRunContext;
 }
+type RequestContextEvent = {
+    context?: Record<string, unknown>;
+};
+export declare function markVerifiedServiceIdentityForEvent(event: RequestContextEvent, identity: {
+    userEmail: string;
+    orgId: string;
+}): void;
+export declare function getVerifiedServiceIdentityFromEvent(event: RequestContextEvent): {
+    userEmail: string;
+    orgId: string;
+} | undefined;
 export declare function markExplicitPersonalOrgScope(event: {
     context?: Record<string, unknown>;
 }): void;

package/dist/server/request-context.js

@@ -38,6 +38,23 @@ function processEnv(name) {
     return process.env?.[name];
 }
 const EXPLICIT_PERSONAL_ORG_SCOPE_KEY = "__anExplicitPersonalOrgScope";
+const VERIFIED_SERVICE_IDENTITY_EVENT_KEY = "__anVerifiedServiceIdentity";
+export function markVerifiedServiceIdentityForEvent(event, identity) {
+    const context = (event.context ??= {});
+    context[VERIFIED_SERVICE_IDENTITY_EVENT_KEY] = identity;
+}
+export function getVerifiedServiceIdentityFromEvent(event) {
+    const identity = event.context?.[VERIFIED_SERVICE_IDENTITY_EVENT_KEY];
+    const userEmail = identity?.userEmail;
+    const orgId = identity?.orgId;
+    if (typeof userEmail !== "string" ||
+        !userEmail.trim() ||
+        typeof orgId !== "string" ||
+        !orgId.trim()) {
+        return undefined;
+    }
+    return { userEmail: userEmail.trim(), orgId: orgId.trim() };
+}
 export function markExplicitPersonalOrgScope(event) {
     if (event.context) {
         event.context[EXPLICIT_PERSONAL_ORG_SCOPE_KEY] = true;

package/dist/shared/agent-chat-context.d.ts

@@ -2,3 +2,4 @@ import { splitAgentKitMessageContext } from "@agent-native/agentkit/chat-context
 export { appendAgentChatContextToMessage } from "@agent-native/agentkit/chat-context";
 export type { AgentKitMessageParts as AgentChatMessageParts } from "@agent-native/agentkit/chat-context";
 export declare const splitAgentChatContextFromMessage: typeof splitAgentKitMessageContext;
+export declare function stripAgentChatContextFromMessage(text: string): string;

package/dist/shared/agent-chat-context.js

@@ -1,3 +1,29 @@
 import { splitAgentKitMessageContext } from "@agent-native/agentkit/chat-context";
 export { appendAgentChatContextToMessage } from "@agent-native/agentkit/chat-context";
 export const splitAgentChatContextFromMessage = splitAgentKitMessageContext;
+const ENCODED_AGENT_CHAT_CONTEXT_OPENING = '<context data-agentkit-context-encoding="entities-v1">';
+const LEGACY_CONTEXT_OPEN_PATTERN = /<context(?=[\s>])[^>]*>/gi;
+export function stripAgentChatContextFromMessage(text) {
+    LEGACY_CONTEXT_OPEN_PATTERN.lastIndex = 0;
+    const opening = LEGACY_CONTEXT_OPEN_PATTERN.exec(text);
+    if (!opening)
+        return text;
+    if (opening[0] === ENCODED_AGENT_CHAT_CONTEXT_OPENING)
+        return splitAgentChatContextFromMessage(text).message;
+    const closingPattern = /<\/context(?=[\s>])[^>]*>/gi;
+    closingPattern.lastIndex = opening.index + opening[0].length;
+    let lastClosing = null;
+    let closing = closingPattern.exec(text);
+    while (closing) {
+        lastClosing = closing;
+        closing = closingPattern.exec(text);
+    }
+    if (!lastClosing)
+        return text.slice(0, opening.index);
+    LEGACY_CONTEXT_OPEN_PATTERN.lastIndex =
+        lastClosing.index + lastClosing[0].length;
+    if (LEGACY_CONTEXT_OPEN_PATTERN.exec(text))
+        return text.slice(0, opening.index);
+    return (text.slice(0, opening.index) +
+        text.slice(lastClosing.index + lastClosing[0].length));
+}

package/dist/shared/index.d.ts

@@ -1,5 +1,5 @@
 export { agentChat, type AgentChatMessage, type AgentChatCallOptions, type AgentChatResponse, } from "./agent-chat.js";
-export { appendAgentChatContextToMessage, splitAgentChatContextFromMessage, type AgentChatMessageParts, } from "./agent-chat-context.js";
+export { appendAgentChatContextToMessage, splitAgentChatContextFromMessage, stripAgentChatContextFromMessage, type AgentChatMessageParts, } from "./agent-chat-context.js";
 export { agentEnv, type EnvVar } from "./agent-env.js";
 export { APP_STATUS, DEFAULT_APP_STATUS, getAppStatus, type AppStatus, } from "./app-status.js";
 export { extractOAuthStateAppId, extractOAuthStateProvider, } from "./oauth-state.js";

package/dist/shared/index.js

@@ -1,5 +1,5 @@
 export { agentChat, } from "./agent-chat.js";
-export { appendAgentChatContextToMessage, splitAgentChatContextFromMessage, } from "./agent-chat-context.js";
+export { appendAgentChatContextToMessage, splitAgentChatContextFromMessage, stripAgentChatContextFromMessage, } from "./agent-chat-context.js";
 export { agentEnv } from "./agent-env.js";
 export { APP_STATUS, DEFAULT_APP_STATUS, getAppStatus, } from "./app-status.js";
 export { extractOAuthStateAppId, extractOAuthStateProvider, } from "./oauth-state.js";

package/dist/shared/reasoning-effort.js

@@ -116,8 +116,11 @@ function isClaudeReasoningModel(model) {
         return true;
     if (id.includes("sonnet-5") || id.includes("sonnet-4-6"))
         return true;
-    if (id.includes("haiku-4-5"))
+    if (id.includes("haiku-5-5") ||
+        id.includes("haiku-5.5") ||
+        id.includes("haiku-4-5")) {
         return true;
+    }
     return claudeOpusAtLeast(id, 4, 6);
 }
 export function supportsClaudeAdaptiveThinking(model) {
@@ -126,6 +129,8 @@ export function supportsClaudeAdaptiveThinking(model) {
     const id = model.toLowerCase().replace(/^anthropic\//, "");
     if (id.includes("fable-5") || id.includes("mythos-5"))
         return true;
+    if (id.includes("haiku-5-5") || id.includes("haiku-5.5"))
+        return true;
     if (id.includes("sonnet-5") || id.includes("sonnet-4-6"))
         return true;
     return claudeOpusAtLeast(id, 4, 6);
@@ -150,6 +155,8 @@ function supportsClaudeXHigh(model) {
     const id = model.toLowerCase().replace(/^anthropic\//, "");
     if (id.includes("fable-5"))
         return true;
+    if (id.includes("haiku-5-5") || id.includes("haiku-5.5"))
+        return true;
     if (id.includes("sonnet-5"))
         return true;
     return claudeOpusAtLeast(id, 4, 7);
@@ -161,6 +168,8 @@ function claudeAcceptsSamplingParams(model) {
     const id = model.toLowerCase().replace(/^anthropic\//, "");
     if (id.includes("fable-5") || id.includes("mythos-5"))
         return false;
+    if (id.includes("haiku-5-5") || id.includes("haiku-5.5"))
+        return false;
     if (id.includes("sonnet-5"))
         return false;
     return !claudeOpusAtLeast(id, 4, 7);

package/dist/shared/ssr-session-bootstrap.d.ts

@@ -27,4 +27,11 @@ export declare function isSessionNavigationPending(): boolean;
 export declare function navigateForSession(href: string): boolean;
 /** Calls `listener` whenever a claimed navigation is released. */
 export declare function subscribeSessionNavigation(listener: () => void): () => void;
+/**
+ * Whether this browser carries the readable cookie the server keeps beside a
+ * signed-in session. It says a session is likely, never that one exists: the
+ * session read decides. Same rule as the bootstrap script below, so a read
+ * started on it starts exactly when the early session read does.
+ */
+export declare function hasSessionHint(sessionHintCookieName?: string): boolean;
 export declare function getSsrSessionBootstrapScriptBody(sessionPath: string, sessionHintCookieName?: string): string;

package/dist/shared/ssr-session-bootstrap.js

@@ -50,6 +50,27 @@ export function subscribeSessionNavigation(listener) {
     window.addEventListener(SESSION_NAVIGATION_RELEASED_EVENT, listener);
     return () => window.removeEventListener(SESSION_NAVIGATION_RELEASED_EVENT, listener);
 }
+/**
+ * Whether this browser carries the readable cookie the server keeps beside a
+ * signed-in session. It says a session is likely, never that one exists: the
+ * session read decides. Same rule as the bootstrap script below, so a read
+ * started on it starts exactly when the early session read does.
+ */
+export function hasSessionHint(sessionHintCookieName) {
+    if (typeof document === "undefined")
+        return false;
+    return document.cookie.split(";").some((cookie) => {
+        const entry = cookie.trim();
+        const separator = entry.indexOf("=");
+        if (separator < 1 || entry.slice(separator + 1) !== "1")
+            return false;
+        const name = entry.slice(0, separator);
+        return sessionHintCookieName
+            ? name === sessionHintCookieName
+            : name === "an_session_hint" ||
+                (name.startsWith("an_session_") && name.endsWith("_hint"));
+    });
+}
 export function getSsrSessionBootstrapScriptBody(sessionPath, sessionHintCookieName) {
     return `(function __anEarlySessionBootstrap() {
   if (window.__agentNativeSessionBootstrap) return;

package/dist/sharing/access.js

@@ -4,8 +4,8 @@ import { getScopedDbExec, withDbExec } from "../db/client.js";
 import { evaluateFeatureFlagStrict } from "../feature-flags/store.js";
 import { CROSS_APP_ORG_FEDERATION_FLAG } from "../org/feature-flags.js";
 import { isMissingOrganizationTableError } from "../org/membership.js";
-import { orgMembers } from "../org/schema.js";
-import { organizations } from "../org/schema.js";
+import { orgMembers, organizations } from "../org/schema.js";
+import { implicitServiceOrgRole } from "../org/service-identity.js";
 import { getRequestAuthCapability, getRequestContext, getRequestUserEmail, getRequestOrgId, } from "../server/request-context.js";
 import { workspaceUserGroupsIncludeUser, workspaceUserGroupsTable, } from "../workspace-connections/groups.js";
 import { listShareableResources, requireShareableResource, } from "./registry.js";
@@ -63,8 +63,86 @@ function normalizeEmailForAccess(email) {
 function emailColumnMatches(column, email) {
     return sql `lower(${column}) = ${email}`;
 }
+function orgMembershipScope(ctx, orgId) {
+    const requestContext = getRequestContext();
+    const serviceIdentity = requestContext?.verifiedServiceIdentity;
+    const normalizedUserEmail = normalizeEmailForAccess(ctx.userEmail);
+    if (serviceIdentity) {
+        if (normalizeEmailForAccess(serviceIdentity.userEmail) !==
+            normalizedUserEmail ||
+            serviceIdentity.orgId !== orgId ||
+            requestContext.orgId !== orgId ||
+            ctx.orgId !== orgId ||
+            !implicitServiceOrgRole({
+                email: serviceIdentity.userEmail,
+                orgId,
+                requestOrgId: requestContext.orgId,
+            })) {
+            return sql `1=0`;
+        }
+        return sql `exists (
+      select 1 from organizations as service_org
+      where service_org.id = ${orgId}
+        and coalesce(trim(service_org.identity_authority), '') = ''
+        and coalesce(trim(service_org.identity_id), '') = ''
+    )`;
+    }
+    if (implicitServiceOrgRole({
+        email: ctx.userEmail,
+        orgId,
+        requestOrgId: ctx.orgId,
+    })) {
+        const federationGuard = ctx.federationMembershipValidated === true
+            ? sql `1=1`
+            : sql `not exists (
+            select 1 from organizations as federation_org
+            where federation_org.id = ${orgId}
+              and (
+                coalesce(trim(federation_org.identity_authority), '') <> ''
+                or coalesce(trim(federation_org.identity_id), '') <> ''
+              )
+          )`;
+        return sql `exists (
+      select 1 from org_members as service_alias_member
+      where service_alias_member.org_id = ${orgId}
+        and lower(service_alias_member.email) = ${normalizedUserEmail}
+        and service_alias_member.federation_removal_pending_at is null
+    ) and ${federationGuard}`;
+    }
+    return sql `1=1`;
+}
 async function isOrgMember(reg, memberOrgId, email, ctx) {
+    const requestContext = getRequestContext();
+    const verifiedServiceIdentity = requestContext?.verifiedServiceIdentity;
     const db = reg.getDb();
+    if (normalizeEmailForAccess(requestContext?.userEmail) === email &&
+        normalizeEmailForAccess(verifiedServiceIdentity?.userEmail) === email &&
+        implicitServiceOrgRole({
+            email: verifiedServiceIdentity?.userEmail,
+            orgId: memberOrgId,
+            requestOrgId: requestContext?.orgId,
+        }) &&
+        verifiedServiceIdentity?.orgId === memberOrgId) {
+        try {
+            const [organization] = await db
+                .select({
+                identityAuthority: organizations.identityAuthority,
+                identityId: organizations.identityId,
+            })
+                .from(organizations)
+                .where(eq(organizations.id, memberOrgId))
+                .limit(1);
+            if (organization &&
+                !String(organization.identityAuthority ?? "").trim() &&
+                !String(organization.identityId ?? "").trim()) {
+                return true;
+            }
+        }
+        catch (error) {
+            if (!isMissingOrganizationTableError(error))
+                throw error;
+        }
+    }
     let rows;
     try {
         rows = await db
@@ -123,6 +201,7 @@ export function accessFilter(resourceTable, sharesTable, rawCtx = currentAccess(
     const publicAllowed = reg?.allowPublic !== false;
     const includePublic = (options.includePublic ?? false) && publicAllowed;
     const clauses = [];
+    const orgMembership = orgId ? orgMembershipScope(ctx, orgId) : sql `1=1`;
     if (normalizedUserEmail) {
         clauses.push(and(emailColumnMatches(resourceTable.ownerEmail, normalizedUserEmail), ownerScopeFilter(reg, resourceTable, ctx)));
     }
@@ -131,7 +210,7 @@ export function accessFilter(resourceTable, sharesTable, rawCtx = currentAccess(
             clauses.push(eq(resourceTable.visibility, "public"));
         }
         if (orgId) {
-            clauses.push(and(eq(resourceTable.visibility, "org"), eq(resourceTable.orgId, orgId)));
+            clauses.push(and(eq(resourceTable.visibility, "org"), eq(resourceTable.orgId, orgId), orgMembership));
         }
     }
     if (normalizedUserEmail) {
@@ -149,6 +228,7 @@ export function accessFilter(resourceTable, sharesTable, rawCtx = currentAccess(
                   where ${sharesTable.resourceId} = ${resourceTable.id}
                     and ${sharesTable.principalType} = 'org'
                     and ${sharesTable.principalId} = ${orgId}
+                    and ${orgMembership}
                     and ${shareScope}
                     and ${minRoleSql(minRole)})`);
     }
@@ -160,8 +240,8 @@ export function accessFilter(resourceTable, sharesTable, rawCtx = currentAccess(
             select 1 from organizations as federation_org
             where federation_org.id = ${resourceTable.orgId}
               and (
-                federation_org.identity_authority is not null
-                or federation_org.identity_id is not null
+                coalesce(trim(federation_org.identity_authority), '') <> ''
+                or coalesce(trim(federation_org.identity_id), '') <> ''
               )
           )`;
         const groupMemberPredicate = sql `exists (
@@ -180,6 +260,7 @@ export function accessFilter(resourceTable, sharesTable, rawCtx = currentAccess(
                       where workspace_group.id = ${sharesTable.principalId}
                         and workspace_group.org_id = ${resourceTable.orgId}
                         and workspace_group.org_id = ${orgId}
+                        and ${orgMembership}
                         and ${federationGuard}
                         and exists (
                           select 1 from ${orgMembers} as workspace_member

package/dist/templates/builder-code-starter/server/routes/index.get.ts

@@ -0,0 +1,2 @@
+// Nitro's [...page] catch-all doesn't match "/", and this starter serves its home page at "/".
+export { default } from "./[...page].get.js";

package/dist/triggers/routes.js

@@ -8,6 +8,7 @@ import { insertPendingTask, isDuplicateEventError, } from "../integrations/pendi
 import { RESUME_AUTOMATION_PATCH } from "../jobs/automation-outcome.js";
 import { nextOccurrence, describeCron, effectiveTimezone, isValidCron, } from "../jobs/cron.js";
 import { parseJobResource, patchJobFrontmatterFields, } from "../jobs/frontmatter.js";
+import { automationRunOwnership } from "../jobs/run-history-ownership.js";
 import { getOrgContext } from "../org/context.js";
 import { organizationIdFromResourceOwner, organizationResourceOwner, resourceGetByPath, resourceListAllOwners, resourcePut, SHARED_OWNER, } from "../resources/store.js";
 import { getSession } from "../server/auth.js";
@@ -135,7 +136,7 @@ async function resourceToAutomationItem(event, userEmail, resource) {
         owner: resource.owner,
         appId: meta.appId,
         orgId: meta.orgId,
-        scope: resource.owner === userEmail && !meta.orgId ? "personal" : "organization",
+        scope: automationRunOwnership(resource.owner, userEmail, meta.orgId).scope,
         canUpdate,
         triggerType: meta.triggerType,
         event: meta.event,

package/docs/content/automation-connectors.mdx

@@ -22,9 +22,9 @@ An app assigns each workflow a stable ID, a connector ID, input/output schemas,
 
 ## Worked example: notify Slack via n8n {#worked-example}
 
-An app that wants to hand a "notify sales" job to an n8n workflow defines it once, then invokes it by ID — never by URL:
+An app that wants to hand a "notify sales" job to an n8n workflow defines it once, then invokes it by ID — never by URL. No first-party template configures a workflow connector yet, so an app opts in by adding an action like this one:
 
-```ts filename="server/plugins/automation-connectors.ts"
+```ts filename="actions/invoke-automation-workflow.ts"
 import {
   createAutomationRuntime,
   createInvokeAutomationWorkflowAction,
@@ -57,7 +57,7 @@ const automation = createAutomationRuntime({
         baseUrl: "https://n8n.example.com",
         path: "/webhook/notify-sales",
         method: "POST",
-        headers: { Authorization: "Bearer ${keys.N8N_WEBHOOK_TOKEN}" },
+        headers: { Authorization: "Bearer ${keys.N8N_WEBHOOK_CREDENTIAL}" },
         timeoutMs: 10_000,
       },
     },
@@ -80,6 +80,8 @@ export default createInvokeAutomationWorkflowAction(automation);
 
 The agent calls this action with `{ workflowId: "notify-sales-slack", input: { leadEmail: "jane@acme.com" } }` — it never sees `https://n8n.example.com/webhook/notify-sales` or the bearer token. `outbound.baseUrl` + `outbound.path` are static, app-owned config; the runtime rejects any attempt to call a different origin.
 
+`N8N_WEBHOOK_CREDENTIAL` is the credential name the n8n integration lists. Save the credential as a key with that name, and `${keys.N8N_WEBHOOK_CREDENTIAL}` resolves it server-side. The file name sets the action name, so the agent sees this tool as `invoke-automation-workflow`.
+
 Mount callback handlers only under `/_agent-native/automations/`; all normal app operations remain actions. Keep the callback route minimal: authenticate, claim idempotency, enqueue, and acknowledge — never run an agent loop inside the webhook request itself.
 
 The client calls a registered action with `invokeConfiguredAutomationWorkflow()` from `@agent-native/core/client`; it does not hand-write a browser `fetch`.

package/docs/content/automations.mdx

@@ -5,11 +5,12 @@ description: "Event-triggered and scheduled automations with natural-language co
 
 # Automations
 
-An **automation** is an agent-executed task that fires on a schedule or when an
-event occurs: _when X happens, do Y_. **Scheduled** and **Event** are the two
-trigger types, not separate products. The agent executes the instructions with
-the same action and tool lifecycle as interactive chat; connected MCP access is
-limited to the automation's explicit `mcpTools` allowlist.
+An **automation** is an agent-executed task that fires on a schedule, when an
+event occurs, or when a webhook is called: _when X happens, do Y_.
+**Scheduled**, **Event**, and **Webhook** are trigger types, not separate
+products. The agent executes the instructions with the same action and tool
+lifecycle as interactive chat; connected MCP access is limited to the
+automation's explicit `mcpTools` allowlist.
 
 The framework originally exposed scheduled automations as **Recurring Jobs**.
 That name, the `jobs/<name>.md` storage path, and the `manage-jobs` tool remain
@@ -29,7 +30,7 @@ schedule-only integration or working with scheduler internals.
   <div class="diagram-card">
     <span class="diagram-pill">Condition</span
     ><small class="diagram-muted"
-      >Haiku checks: &ldquo;email ends with @builder.io&rdquo;</small
+      >Model checks: &ldquo;email ends with @builder.io&rdquo;</small
     >
   </div>
   <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
@@ -63,14 +64,32 @@ schedule-only integration or working with scheduler internals.
 
 </Diagram>
 
-## Two trigger types {#trigger-types}
+## Trigger types {#trigger-types}
 
-| Type       | Fires when                                             | Key field         |
-| ---------- | ------------------------------------------------------ | ----------------- |
-| `schedule` | A cron expression matches (same as recurring jobs)     | `schedule` (cron) |
-| `event`    | A matching event is emitted on the framework event bus | `event` (name)    |
+| Type       | Fires when                                                    | Key field                          |
+| ---------- | ------------------------------------------------------------- | ---------------------------------- |
+| `schedule` | A cron expression matches (same as recurring jobs)            | `schedule` (cron)                  |
+| `event`    | A matching event is emitted on the framework event bus        | `event` (name)                     |
+| `webhook`  | An HTTP `POST` arrives at the automation's secret webhook URL | The URL returned when it's created |
 
-Event triggers can include a `condition` — a natural-language string evaluated by Haiku against the event payload before dispatch. If the condition doesn't match, the automation is silently skipped.
+Event and webhook triggers can include a `condition`: a natural-language string a model checks against the payload before dispatch. If the condition doesn't match, the automation is skipped and records a `skipped` status. If the condition can't be evaluated, the automation doesn't run. See [Conditions](#conditions).
+
+### Webhook triggers {#webhook-triggers}
+
+Creating a webhook automation returns a URL path of the form
+`/_agent-native/automations/webhook/<token>`. The token is the secret, so give
+the URL only to the service that calls it. Each `POST` to that URL becomes the
+automation's payload, up to 64 KB. A body sent with a JSON content type is
+parsed, and any other body is passed as text. The endpoint answers `202` and
+runs the automation in the background.
+
+Send a stable event ID in an `X-Webhook-Event-Id`, `X-Event-Id`, or
+`X-GitHub-Delivery` header, or as a top-level string `id` in a JSON body. A
+repeated delivery with the same ID isn't queued again and gets a `200` reply
+marked as a duplicate. The ID only stops duplicate deliveries. A failed run can
+be retried, and the retry can repeat side effects the failed run already
+caused. Once a delivery fails for good, its ID is released, and a later
+delivery with that ID is queued as a new one.
 
 ## Creating automations {#creating}
 
@@ -82,10 +101,17 @@ The agent discovers available events, confirms the plan, and writes the automati
 
 ### From the Automations UI
 
-Open **Automations** on the full-page Agent surface. It is the primary place to
-view scheduled and event-triggered automations, inspect status, pause or resume
-them, and delete them. Its compatibility URL remains `/agent#jobs`, so existing
-links and bookmarks continue to work.
+Open **Settings › Automations**. It is the primary place to view scheduled,
+event-triggered, and webhook-triggered automations, inspect status, run one
+now, pause or resume them, and delete them. Old `/agent#jobs` links redirect
+there.
+
+**Run now** is the quickest way to test an automation. It runs the
+automation's instructions immediately, with their real side effects. It skips
+the trigger and the condition, and it doesn't change the next scheduled run,
+with one exception: if the framework paused the automation, a successful run
+turns it back on, and a scheduled automation gets its next run calculated
+again. The agent can do the same with `manage-automations` and `action=run-now`.
 
 <Callout tone="info">
 
@@ -120,7 +146,7 @@ The third path — writing the `jobs/<name>.md` file by hand via `resourcePut`
     {
       lines: "6",
       label: "Gate",
-      note: "An optional natural-language `condition`, evaluated by Haiku against the payload before dispatch.",
+      note: "An optional natural-language `condition`, checked by a model against the payload before dispatch.",
     },
     {
       lines: "12",
@@ -134,15 +160,15 @@ The third path — writing the `jobs/<name>.md` file by hand via `resourcePut`
 
 Automations share every field in the [recurring-jobs frontmatter table](/docs/recurring-jobs#frontmatter). These additional fields control event triggers, conditions, and the execution mode:
 
-| Field         | Type                      | Default      | Description                                                                                                                                   |
-| ------------- | ------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
-| `triggerType` | `"schedule"` \| `"event"` | `"schedule"` | How the automation fires                                                                                                                      |
-| `event`       | string                    | _(optional)_ | Event name to subscribe to (event triggers only)                                                                                              |
-| `condition`   | string                    | _(optional)_ | Natural-language condition evaluated before dispatch                                                                                          |
-| `mode`        | `"agentic"`               | `"agentic"`  | Full agent loop (the only supported mode). `"deterministic"` was removed — it was never implemented, and automations that set it never fired. |
-| `domain`      | string                    | _(optional)_ | Grouping tag (mail, calendar, clips, etc.)                                                                                                    |
+| Field         | Type                                     | Default      | Description                                                                                                                                   |
+| ------------- | ---------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
+| `triggerType` | `"schedule"` \| `"event"` \| `"webhook"` | `"schedule"` | How the automation fires                                                                                                                      |
+| `event`       | string                                   | _(optional)_ | Event name to subscribe to (event triggers only)                                                                                              |
+| `condition`   | string                                   | _(optional)_ | Natural-language condition evaluated before dispatch (event and webhook triggers)                                                             |
+| `mode`        | `"agentic"`                              | `"agentic"`  | Full agent loop (the only supported mode). `"deterministic"` was removed — it was never implemented, and automations that set it never fired. |
+| `domain`      | string                                   | _(optional)_ | Grouping tag (mail, calendar, clips, etc.)                                                                                                    |
 
-For an event trigger, `schedule` is `""` (empty); for a schedule trigger it carries the cron expression. The dispatcher also writes the same managed `lastRun` / `lastStatus` / `lastError` fields the scheduler does, plus a `"skipped"` status when a condition evaluates to false.
+For an event or webhook trigger, `schedule` is `""` (empty); for a schedule trigger it carries the cron expression. The dispatcher also writes the same managed `lastRun` / `lastStatus` / `lastError` fields the scheduler does, plus a `"skipped"` status when a condition evaluates to false. When a condition can't be evaluated, see [Conditions](#conditions) for what gets recorded.
 
 `model` selects a per-automation model. `mcpTools` is an explicit list of MCP
 tool names such as `mcp__server__tool`. The shared execution runner exposes
@@ -224,15 +250,15 @@ organization event automations both require an exact match with their
 
 ## Conditions {#conditions}
 
-Conditions are natural-language strings evaluated by Claude Haiku against the event payload. This is a yes/no classification, not a generation task.
+Conditions are natural-language strings a model checks against the event or webhook payload. This is a yes/no classification, not a generation task.
 
 - **Empty or missing condition** = unconditional (always fires).
-- Results are memoized (SHA-256 of condition + payload) with a 5-minute TTL and 500-entry LRU cache.
-- Payload is truncated to 4000 characters before sending to Haiku.
+- Results are cached for 5 minutes, keyed by a SHA-256 hash of the condition and payload, with at most 500 entries.
+- Payload is truncated to 4000 characters before it is sent to the model.
 
 <Callout tone="info">
 
-On API failure, the condition evaluates to `false` (safe default — the automation is skipped rather than run on an unverified condition).
+A condition that can't be evaluated never counts as a match or as a non-match, and the automation doesn't run. A provider error records `lastStatus: error` with the reason in `lastError`, and the event is retried. If no API key is available to evaluate the condition, an event automation records an error for each matching event and pauses itself after three in a row. Once a key is available, a running scheduler turns it back on by itself within about 15 minutes. On a host where no scheduler runs, turn it back on in **Settings › Automations**. A webhook automation in the same state doesn't pause. Its delivery fails and is retried.
 
 </Callout>
 
@@ -283,7 +309,7 @@ Placeholders are resolved **server-side** after the agent emits the tool call
 Keys are ad-hoc secrets created by users or the agent for automation use (e.g. `SLACK_WEBHOOK`, `HUBSPOT_API_KEY`). They differ from registered secrets (`registerRequiredSecret`) in that they have no template-defined metadata or onboarding step.
 
 - Created via the settings UI or the `/_agent-native/secrets/adhoc` API.
-- Each key can have a **URL allowlist** that restricts which origins the key can be sent to (origin-level matching).
+- A key created through the API can include a `urlAllowlist` that restricts which origins the key can be sent to (origin-level matching). Keys added in Settings have no allowlist.
 - The raw value is never exposed to the AI — only `${keys.NAME}` placeholders appear in the agent's context.
 - Resolution falls back from user scope to workspace scope, so users can override shared keys.
 
@@ -292,14 +318,16 @@ Keys are ad-hoc secrets created by users or the agent for automation use (e.g. `
 Trigger-aware personal and organization operations use `manage-automations`
 with an `action` parameter:
 
-| Action        | Purpose                                                              |
-| ------------- | -------------------------------------------------------------------- |
-| `list-events` | Discover all registered events with descriptions and payload schemas |
-| `list`        | List all automations with status; filter by domain or enabled        |
-| `define`      | Create a new automation (name, trigger type, event, condition, body) |
-| `update`      | Update an existing automation (enabled, condition, body)             |
-| `delete`      | Delete an automation (always confirms with user first)               |
-| `fire-test`   | Emit a `test.event.fired` event to validate automations              |
+| Action        | Purpose                                                                                  |
+| ------------- | ---------------------------------------------------------------------------------------- |
+| `list-events` | Discover all registered events with descriptions and payload schemas                     |
+| `list-hosts`  | List paired execution hosts before assigning one to an automation                        |
+| `list`        | List all automations with status; filter by domain or enabled                            |
+| `define`      | Create a new automation (name, trigger type, event, condition, body)                     |
+| `update`      | Update an existing automation (enabled, condition, body)                                 |
+| `delete`      | Delete an automation (always confirms with user first)                                   |
+| `run-now`     | Run one automation immediately, with real side effects. Skips the trigger and condition. |
+| `fire-test`   | Emit a `test.event.fired` event. Only automations subscribed to that event respond.      |
 
 Additional tool: `web-request` — outbound HTTP with `${keys.NAME}` substitution.
 
@@ -309,22 +337,23 @@ tool for existing schedule-only integrations and delivery metadata.
 
 ## API endpoints {#api}
 
-| Endpoint                               | Method | Description                     |
-| -------------------------------------- | ------ | ------------------------------- |
-| `/_agent-native/automations`           | GET    | List all automations (parsed)   |
-| `/_agent-native/automations/fire-test` | POST   | Emit a `test.event.fired` event |
-| `/_agent-native/secrets/adhoc`         | GET    | List ad-hoc keys (no values)    |
-| `/_agent-native/secrets/adhoc`         | POST   | Create or update an ad-hoc key  |
-| `/_agent-native/secrets/adhoc/:name`   | DELETE | Delete an ad-hoc key            |
+| Endpoint                                    | Method | Description                     |
+| ------------------------------------------- | ------ | ------------------------------- |
+| `/_agent-native/automations`                | GET    | List all automations (parsed)   |
+| `/_agent-native/automations/fire-test`      | POST   | Emit a `test.event.fired` event |
+| `/_agent-native/automations/webhook/:token` | POST   | Trigger a webhook automation    |
+| `/_agent-native/secrets/adhoc`              | GET    | List ad-hoc keys (no values)    |
+| `/_agent-native/secrets/adhoc`              | POST   | Create or update an ad-hoc key  |
+| `/_agent-native/secrets/adhoc/:name`        | DELETE | Delete an ad-hoc key            |
 
-<Endpoint id="doc-block-uyjlfp" title="Fire a test event" method="POST" path="/_agent-native/automations/fire-test" summary="Emit a test.event.fired event to validate event-triggered automations" responses={[
+<Endpoint id="doc-block-uyjlfp" title="Fire a test event" method="POST" path="/_agent-native/automations/fire-test" summary="Emit a test.event.fired event to exercise automations subscribed to it" responses={[
   {
     "status": "200",
     "description": "Event emitted; matching automations are dispatched through the normal condition + ownership path."
   }
 ]}>
 
-Confirm an automation's wiring and condition without waiting for a real provider event. Equivalent to the `manage-automations` action `fire-test`.
+Checks the event path (matching, owner scoping, and condition) for an automation subscribed to `test.event.fired`. It emits only that event, so it can't trigger an automation that listens for a real event such as `calendar.booking.created`. To try a real automation, use **Run now**. Equivalent to the `manage-automations` action `fire-test`.
 
 </Endpoint>
 
@@ -354,8 +383,8 @@ Confirm an automation's wiring and condition without waiting for a real provider
   <div class="diagram-card">
     <span class="diagram-pill warn">condition</span
     ><small class="diagram-muted"
-      >Haiku yes/no on the payload &mdash; false &rarr;
-      <code>skipped</code></small
+      >model yes/no on the payload &mdash; false &rarr; <code>skipped</code>,
+      failure &rarr; <code>error</code></small
     >
   </div>
   <div class="diagram-arrow diagram-muted" aria-hidden="true">&darr;</div>