@agent-native/core 0.209.1 → 0.209.2-nightly-20261015213030

package/dist/client/use-action.js

@@ -15,6 +15,7 @@ import { agentNativeApiDisabledReason, assertAgentNativeApiEnabled, } from "./ap
 import { getBrowserTabId } from "./browser-tab-id.js";
 import { clientBuildId, clientCompatibilityVersion, reloadForClientCompatibilityMismatch, } from "./build-compatibility.js";
 import { ensureEmbedAuthFetchInterceptor, isEmbedAuthActive, } from "./embed-auth.js";
+import { recordActionStart } from "./recorder.js";
 import { currentRouteTemplate } from "./route-template.js";
 import { recheckSessionAfterUnauthorized } from "./use-session.js";
 function actionPrefix() {
@@ -490,6 +491,7 @@ async function actionFetch(name, method, params, options) {
     const hiddenEpochAtStart = pageHiddenEpoch;
     const hiddenAtStart = typeof document !== "undefined" && document.visibilityState !== "visible";
     const timeoutMs = options?.timeoutMs ?? DEFAULT_ACTION_TIMEOUT_MS;
+    const recordActionEnd = recordActionStart(name, method);
     let response;
     let responseAt;
     let error;
@@ -509,6 +511,7 @@ async function actionFetch(name, method, params, options) {
     }
     finally {
         try {
+            recordActionEnd({ error, response, signal: options?.signal });
             const completedAt = actionTelemetryNow();
             const durationMs = Math.max(0, completedAt - startedAt);
             const sampling = getActionResponseSampling(error, durationMs, response);

package/dist/collab/routes.d.ts

@@ -13,8 +13,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
     };
 }>>;
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/collab/struct-routes.d.ts

@@ -1,6 +1,6 @@
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/file-upload/actions/upload-image.d.ts

@@ -33,9 +33,9 @@ declare const _default: import("../../action.js").ActionDefinition<{
     idempotencyKey: string;
     deleted: boolean;
 } | {
+    id?: undefined;
     error: string;
     url?: undefined;
-    id?: undefined;
     provider?: undefined;
     configured?: undefined;
 } | {
@@ -45,8 +45,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     configured?: undefined;
     error?: undefined;
 } | {
-    url?: undefined;
     id?: undefined;
+    url?: undefined;
     provider?: undefined;
     error: string;
     configured: boolean;

package/dist/integrations/google-docs-poller.js

@@ -7,12 +7,12 @@ import { startRun } from "../agent/run-manager.js";
 import { buildAssistantMessage, extractThreadMeta, } from "../agent/thread-data-builder.js";
 import { attachToolSearch } from "../agent/tool-search.js";
 import { createThread, getThread, setThreadSourceIfMissing, updateThreadData, } from "../chat-threads/store.js";
-import { resolveOrgIdForEmail } from "../org/context.js";
 import { startIntervalJob, } from "../server/interval-job.js";
 import { runWithRequestContext } from "../server/request-context.js";
 import { getServiceAccountAccessToken, getServiceAccountEmail, getStartPageToken, googleDocsAdapter, listChanges, listDocComments, } from "./adapters/google-docs.js";
 import { getIntegrationConfig, integrationConfigWriteEpoch, saveIntegrationConfig, saveIntegrationConfigIfUnchanged, } from "./config-store.js";
 import { createGoogleDocsChannelAuth, verifyGoogleDocsChannel, } from "./google-docs-webhook.js";
+import { integrationRequestContext, resolveIntegrationRequestScope, } from "./request-scope.js";
 import { getThreadMapping, saveThreadMapping } from "./thread-mapping-store.js";
 const PLATFORM = "google-docs";
 const DEFAULT_TRIGGER = "@agent";
@@ -466,6 +466,10 @@ export async function handlePushNotification() {
 }
 async function processComment(fileId, commentId, text, senderName, options, existingThreadId) {
     const adapter = googleDocsAdapter();
+    const requestScope = await resolveIntegrationRequestScope({
+        ownerEmail: options.ownerEmail,
+    });
+    const requestContext = integrationRequestContext(requestScope);
     const key = commentKey(fileId, commentId);
     const incoming = {
         platform: PLATFORM,
@@ -481,10 +485,10 @@ async function processComment(fileId, commentId, text, senderName, options, exis
     };
     let threadId = existingThreadId;
     if (!threadId) {
-        const thread = await createThread(options.ownerEmail, {
+        const thread = await runWithRequestContext({ userEmail: options.ownerEmail, ...requestContext }, () => createThread(options.ownerEmail, {
             title: `Google Doc: ${senderName}`,
             source,
-        });
+        }));
         await saveThreadMapping(PLATFORM, key, thread.id, { fileId, commentId });
         threadId = thread.id;
     }
@@ -532,9 +536,12 @@ async function processComment(fileId, commentId, text, senderName, options, exis
     const tools = filterInitialEngineTools(availableTools, options.initialToolNames);
     const runId = `gdocs-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     const capturedThreadId = threadId;
-    const orgId = (await resolveOrgIdForEmail(options.ownerEmail)) ?? undefined;
     startRun(runId, capturedThreadId, async (send, signal) => {
-        await runWithRequestContext({ userEmail: options.ownerEmail, orgId, isIntegrationCaller: true }, () => runAgentLoopDirectWithSoftTimeout({
+        await runWithRequestContext({
+            userEmail: options.ownerEmail,
+            ...requestContext,
+            isIntegrationCaller: true,
+        }, () => runAgentLoopDirectWithSoftTimeout({
             engine,
             model: options.model,
             systemPrompt: options.systemPrompt,

package/dist/integrations/plugin.js

@@ -4,7 +4,7 @@ import { AGENT_BACKGROUND_PROCESSOR_FIELD, AGENT_BACKGROUND_PROCESSOR_INTEGRATIO
 import { abortRun } from "../agent/run-manager.js";
 import { AppConfigurationError, getAppConfig } from "../app-config/index.js";
 import { isServerlessRuntime } from "../db/client.js";
-import { getOrgContext, resolveOrgIdForEmail } from "../org/context.js";
+import { getOrgContext } from "../org/context.js";
 import { loadResourcesForPrompt } from "../server/agent-chat-plugin.js";
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
 import { getSession } from "../server/auth.js";
@@ -49,6 +49,7 @@ import { startRemotePushDeliveryJob } from "./remote-push-delivery-job.js";
 import { listRemotePushNotificationsForOwner, listRemotePushRegistrationsForOwner, queueRemotePushNotifications, toPublicRemotePushRegistration, unregisterRemotePushRegistrationForOwner, upsertRemotePushRegistration, } from "./remote-push-store.js";
 import { startRemoteCommandsRetryJob } from "./remote-retry-job.js";
 import { insertRemoteRunEvents, listRemoteRunEvents, } from "./remote-run-events-store.js";
+import { integrationRequestContext, resolveIntegrationRequestScope, } from "./request-scope.js";
 import { listIntegrationScopes, saveIntegrationScope } from "./scope-store.js";
 import { buildSlackAgentManifest } from "./slack-manifest.js";
 import { assertSlackInstallAccess, buildSlackAuthorizeUrl, exchangeSlackOAuthCode, slackOAuthResponseToInstallation, testSlackAuth, } from "./slack-oauth.js";
@@ -579,7 +580,7 @@ export function createIntegrationsPlugin(options) {
                 .then(operation)
                 .finally(release);
         };
-        const createGoogleDocsPollerOptions = (requestBaseUrl) => {
+        const createGoogleDocsPollerOptions = (ownerEmail, requestBaseUrl) => {
             const configuredBaseUrl = getAppConfig().integrations.webhookBaseUrl;
             const baseUrl = configuredBaseUrl || requestBaseUrl;
             const webhookUrl = baseUrl
@@ -591,7 +592,7 @@ export function createIntegrationsPlugin(options) {
                 initialToolNames,
                 model: model ?? "",
                 apiKey: getApiKey(),
-                ownerEmail: "integration@google-docs",
+                ownerEmail,
                 webhookUrl,
             };
         };
@@ -599,12 +600,22 @@ export function createIntegrationsPlugin(options) {
             adapters,
             webhookUrl: (baseUrl, platform) => `${baseUrl}${P}/${platform}/webhook`,
             async setEnabled(platform, enabled, { actorEmail, baseUrl }) {
-                await saveIntegrationConfig(platform, { enabled }, "default", actorEmail);
-                if (platform !== "google-docs")
+                if (platform === "google-docs") {
+                    if (enabled) {
+                        const ownerEmail = actorEmail?.trim();
+                        if (!ownerEmail) {
+                            throw new Error("Google Docs requires a signed-in owner to start polling.");
+                        }
+                        await saveIntegrationConfig(platform, { enabled }, "default", ownerEmail);
+                        await runGoogleDocsPollerTransition(() => startGoogleDocsPoller(createGoogleDocsPollerOptions(ownerEmail, baseUrl)));
+                    }
+                    else {
+                        await saveIntegrationConfig(platform, { enabled }, "default", actorEmail);
+                        await runGoogleDocsPollerTransition(stopGoogleDocsPoller);
+                    }
                     return;
-                await runGoogleDocsPollerTransition(enabled
-                    ? () => startGoogleDocsPoller(createGoogleDocsPollerOptions(baseUrl))
-                    : stopGoogleDocsPoller);
+                }
+                await saveIntegrationConfig(platform, { enabled }, "default", actorEmail);
             },
             async registerWebhook(platform, baseUrl) {
                 if (platform !== "telegram") {
@@ -715,15 +726,26 @@ export function createIntegrationsPlugin(options) {
                 return null;
             }
             const orgCtx = await getOrgContext(event).catch(() => null);
-            return {
-                ownerEmail: session.email,
-                orgId: orgCtx?.orgId ?? session.orgId ?? null,
-            };
+            try {
+                return {
+                    ownerEmail: session.email,
+                    ...(await resolveIntegrationRequestScope({
+                        ownerEmail: session.email,
+                        orgId: orgCtx?.orgId ?? session.orgId ?? null,
+                        principalType: "user",
+                    })),
+                };
+            }
+            catch (error) {
+                console.error("[integrations] Could not resolve signed-in user's organization scope:", error);
+                setResponseStatus(event, 503);
+                return null;
+            }
         }
         function toCredentialContext(ctx, opts) {
             return {
                 userEmail: ctx.ownerEmail,
-                ...(ctx.orgId ? { orgId: ctx.orgId } : {}),
+                ...integrationRequestContext(ctx),
                 ...(opts?.isIntegrationCaller ? { isIntegrationCaller: true } : {}),
             };
         }
@@ -731,10 +753,12 @@ export function createIntegrationsPlugin(options) {
             const ownerEmail = typeof config?.owner === "string" ? config.owner.trim() : "";
             if (!ownerEmail)
                 return null;
-            const orgId = await resolveOrgIdForEmail(ownerEmail).catch(() => null);
             return {
                 userEmail: ownerEmail,
-                ...(orgId ? { orgId } : {}),
+                ...integrationRequestContext(await resolveIntegrationRequestScope({
+                    ownerEmail,
+                    principalType: "user",
+                })),
                 isIntegrationCaller: true,
             };
         }
@@ -1632,9 +1656,24 @@ export function createIntegrationsPlugin(options) {
                     setResponseStatus(event, 404);
                     return { error: "Unknown platform" };
                 }
+                const principalType = taskPayload.kind === "system-notice"
+                    ? "service"
+                    : "principalType" in taskPayload
+                        ? (taskPayload.principalType ?? "user")
+                        : "user";
+                const orgScope = ("orgScope" in taskPayload ? taskPayload.orgScope : undefined) ??
+                    (task.orgId === null && principalType === "user"
+                        ? "personal"
+                        : undefined);
+                const requestScope = await resolveIntegrationRequestScope({
+                    ownerEmail: task.ownerEmail,
+                    orgId: task.orgId,
+                    orgScope,
+                    principalType,
+                });
                 const processingResult = await runWithRequestContext({
                     userEmail: task.ownerEmail,
-                    ...(task.orgId ? { orgId: task.orgId } : {}),
+                    ...integrationRequestContext(requestScope),
                     isIntegrationCaller: true,
                 }, async () => {
                     if (!campaignContinuation &&
@@ -2283,9 +2322,22 @@ export function createIntegrationsPlugin(options) {
                     error: err instanceof Error ? err.message : "Slack access denied",
                 };
             }
+            let requestScope;
+            try {
+                requestScope = await resolveIntegrationRequestScope({
+                    ownerEmail: session.email,
+                    orgId: org?.orgId ?? session.orgId ?? null,
+                    principalType: "user",
+                });
+            }
+            catch (error) {
+                console.error("[slack] Could not resolve install scope:", error);
+                setResponseStatus(event, 503);
+                return { error: "Could not verify your account scope." };
+            }
             return await runWithRequestContext({
                 userEmail: session.email,
-                orgId: org?.orgId ?? session.orgId ?? undefined,
+                ...integrationRequestContext(requestScope),
             }, async () => {
                 const clientId = await resolveSecret("SLACK_CLIENT_ID");
                 const clientSecret = await resolveSecret("SLACK_CLIENT_SECRET");
@@ -2349,9 +2401,14 @@ export function createIntegrationsPlugin(options) {
                     orgId: org?.orgId ?? session.orgId ?? null,
                     orgRole: org?.role ?? null,
                 });
+                const requestScope = await resolveIntegrationRequestScope({
+                    ownerEmail: access.ownerEmail,
+                    orgId: access.orgId,
+                    principalType: "user",
+                });
                 return await runWithRequestContext({
                     userEmail: access.ownerEmail,
-                    orgId: access.orgId ?? undefined,
+                    ...integrationRequestContext(requestScope),
                 }, async () => {
                     const clientId = await resolveSecret("SLACK_CLIENT_ID");
                     const clientSecret = await resolveSecret("SLACK_CLIENT_SECRET");
@@ -2694,7 +2751,17 @@ export function createIntegrationsPlugin(options) {
             startRemotePushDeliveryJob();
             if (adapterMap.has("google-docs")) {
                 setTimeout(() => {
-                    void runGoogleDocsPollerTransition(() => startGoogleDocsPoller(createGoogleDocsPollerOptions()));
+                    void runGoogleDocsPollerTransition(async () => {
+                        const config = await getIntegrationConfig("google-docs");
+                        const ownerEmail = config?.owner?.trim();
+                        if (!config?.configData?.enabled)
+                            return;
+                        if (!ownerEmail) {
+                            console.error("[google-docs] Cannot start poller without a configured owner");
+                            return;
+                        }
+                        await startGoogleDocsPoller(createGoogleDocsPollerOptions(ownerEmail));
+                    });
                 }, 2000);
             }
         }

package/dist/integrations/request-scope.d.ts

@@ -0,0 +1,16 @@
+export type IntegrationRequestScope = {
+    orgId: string | null;
+    orgScope?: "personal";
+    defaultAgentEngineScope?: "deployment";
+};
+export declare function resolveIntegrationRequestScope(input: {
+    ownerEmail: string;
+    orgId?: string | null;
+    orgScope?: "personal";
+    principalType?: "user" | "service";
+}): Promise<IntegrationRequestScope>;
+export declare function integrationRequestContext(scope: IntegrationRequestScope): {
+    orgId?: string;
+    orgScope?: "personal";
+    defaultAgentEngineScope?: "deployment";
+};

package/dist/integrations/request-scope.js

@@ -0,0 +1,27 @@
+import { resolveOrgScopeForEmail } from "../org/context.js";
+export async function resolveIntegrationRequestScope(input) {
+    const explicitOrgId = input.orgId?.trim();
+    if (explicitOrgId)
+        return { orgId: explicitOrgId };
+    if (input.orgScope === "personal") {
+        return { orgId: null, orgScope: "personal" };
+    }
+    if (input.principalType === "service") {
+        return { orgId: null, defaultAgentEngineScope: "deployment" };
+    }
+    const scope = await resolveOrgScopeForEmail(input.ownerEmail);
+    if (scope.status === "organization")
+        return { orgId: scope.orgId };
+    if (scope.status === "personal")
+        return { orgId: null, orgScope: "personal" };
+    throw new Error("The integration owner's organization scope could not be resolved.");
+}
+export function integrationRequestContext(scope) {
+    return {
+        ...(scope.orgId ? { orgId: scope.orgId } : {}),
+        ...(scope.orgScope ? { orgScope: scope.orgScope } : {}),
+        ...(scope.defaultAgentEngineScope
+            ? { defaultAgentEngineScope: scope.defaultAgentEngineScope }
+            : {}),
+    };
+}

package/dist/integrations/webhook-handler.d.ts

@@ -8,6 +8,8 @@ export type IntegrationResponseDeliveryTaskPayload = {
     kind: "response-delivery";
     incoming: IncomingMessage;
     message: OutgoingMessage;
+    principalType?: "user" | "service";
+    orgScope?: "personal";
     placeholderRef?: string;
     strictTargetRef?: boolean;
     internalThreadId?: string;

package/dist/integrations/webhook-handler.js

@@ -12,7 +12,7 @@ import { buildAssistantMessage, extractThreadMeta, threadDataToEngineMessages, }
 import { attachToolSearch } from "../agent/tool-search.js";
 import { createThread, getThread, grantThreadUserShare, setThreadSourceIfMissing, } from "../chat-threads/store.js";
 import { updateThreadData } from "../chat-threads/store.js";
-import { getOrgA2ASecret, resolveOrgIdForEmail } from "../org/context.js";
+import { getOrgA2ASecret } from "../org/context.js";
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
 import { getAppProductionUrl } from "../server/app-url.js";
 import { runWithRequestContext } from "../server/request-context.js";
@@ -26,6 +26,7 @@ import { claimIntegrationCampaignDeliveryForTask, claimIntegrationCampaign, comp
 import { dispatchPendingIntegrationTask, integrationDispatchScopeValue, } from "./integration-durable-dispatch.js";
 import { loadIntegrationMemoryPrompt } from "./integration-memory.js";
 import { insertPendingTask, isDuplicateEventError, stageTaskDeliveryPayload, } from "./pending-tasks-store.js";
+import { integrationRequestContext, resolveIntegrationRequestScope, } from "./request-scope.js";
 import { integrationScopeSubjectKey } from "./scope-store.js";
 import { getThreadMapping, saveThreadMapping } from "./thread-mapping-store.js";
 import { listIntegrationUsageBudgets, releaseIntegrationUsageBudget, reserveIntegrationUsageBudget, settleIntegrationUsageBudget, } from "./usage-budget-store.js";
@@ -221,15 +222,12 @@ function immediateWebhookResponse(adapter, incoming) {
 }
 async function enqueueAndDispatch(event, incoming, options, handlerStartedAt = Date.now()) {
     const taskId = crypto.randomUUID();
-    let orgId = options.orgId ?? null;
-    if (options.orgId === undefined) {
-        try {
-            orgId = (await resolveOrgIdForEmail(options.ownerEmail)) ?? null;
-        }
-        catch {
-            orgId = null;
-        }
-    }
+    const requestScope = await resolveIntegrationRequestScope({
+        ownerEmail: options.ownerEmail,
+        orgId: options.orgId,
+        principalType: options.principalType,
+    });
+    const orgId = requestScope.orgId;
     let placeholderRef;
     try {
         if (options.adapter.postProcessingPlaceholder) {
@@ -246,6 +244,7 @@ async function enqueueAndDispatch(event, incoming, options, handlerStartedAt = D
         incoming,
         placeholderRef,
         principalType: options.principalType ?? "user",
+        ...(requestScope.orgScope ? { orgScope: requestScope.orgScope } : {}),
     });
     await insertPendingTask({
         id: taskId,
@@ -294,6 +293,9 @@ export function resolveBaseUrl(event) {
 }
 export async function processIntegrationTask(task, options, campaignOptions) {
     const parsed = JSON.parse(task.payload);
+    const principalType = parsed.principalType ?? options.principalType ?? "user";
+    const orgScope = parsed.orgScope ??
+        (task.orgId === null && principalType === "user" ? "personal" : undefined);
     if (!campaignOptions?.continuationInvocation) {
         await recordInboundIntegrationAudit(task, parsed.incoming);
     }
@@ -301,8 +303,9 @@ export async function processIntegrationTask(task, options, campaignOptions) {
         taskId: task.id,
         attempts: task.attempts,
         placeholderRef: parsed.placeholderRef,
-        orgId: task.orgId ?? undefined,
-        principalType: parsed.principalType ?? options.principalType ?? "user",
+        orgId: task.orgId,
+        orgScope,
+        principalType,
         durableCampaign: campaignOptions?.enabled === true,
     });
 }
@@ -341,6 +344,14 @@ async function recordInboundIntegrationAudit(task, incoming) {
 }
 async function processIncomingMessage(incoming, options, opts = {}) {
     const { adapter, systemPrompt, actions, initialToolNames, model, apiKey, ownerEmail, engine: engineOption, } = options;
+    const requestScope = await resolveIntegrationRequestScope({
+        ownerEmail,
+        orgId: opts.orgId === undefined ? options.orgId : opts.orgId,
+        orgScope: opts.orgScope,
+        principalType: opts.principalType,
+    });
+    const orgId = requestScope.orgId;
+    const requestContext = integrationRequestContext(requestScope);
     let effectiveSystemPrompt = systemPrompt + buildRuntimeContextPrompt();
     const deliveryOptions = {
         placeholderRef: opts.placeholderRef,
@@ -395,7 +406,7 @@ async function processIncomingMessage(incoming, options, opts = {}) {
     const budgetReservations = await reserveApplicableIntegrationBudgets({
         incoming,
         ownerEmail,
-        orgId: opts.orgId ?? null,
+        orgId,
         reservationId: opts.taskId ?? `integration:${incoming.externalThreadId}`,
     });
     if (!budgetReservations.allowed) {
@@ -404,6 +415,8 @@ async function processIncomingMessage(incoming, options, opts = {}) {
             kind: "response-delivery",
             incoming,
             message: outgoing,
+            principalType: opts.principalType ?? "user",
+            ...(requestScope.orgScope ? { orgScope: requestScope.orgScope } : {}),
             ...(opts.placeholderRef ? { placeholderRef: opts.placeholderRef } : {}),
         };
         try {
@@ -438,8 +451,7 @@ async function processIncomingMessage(incoming, options, opts = {}) {
     let thread;
     try {
         if (!mapping) {
-            const threadOrgId = opts.orgId ?? (await resolveOrgIdForEmail(ownerEmail));
-            const createdThread = await runWithRequestContext({ userEmail: ownerEmail, orgId: threadOrgId ?? undefined }, () => createThread(ownerEmail, {
+            const createdThread = await runWithRequestContext({ userEmail: ownerEmail, ...requestContext }, () => createThread(ownerEmail, {
                 title: `${adapter.label}: ${incoming.senderName || incoming.senderId || "User"}`,
                 source: {
                     platform: incoming.platform,
@@ -524,6 +536,8 @@ async function processIncomingMessage(incoming, options, opts = {}) {
                 kind: "response-delivery",
                 incoming,
                 message: exhaustedMessage,
+                principalType: opts.principalType ?? "user",
+                ...(requestScope.orgScope ? { orgScope: requestScope.orgScope } : {}),
                 ...(exhaustedProgress?.responseTargetRef
                     ? {
                         placeholderRef: exhaustedProgress.responseTargetRef,
@@ -669,13 +683,11 @@ async function processIncomingMessage(incoming, options, opts = {}) {
             ],
         });
     }
-    let orgId;
     let artifactSecrets;
     let runnableActions;
     let tools;
     let availableTools;
     try {
-        orgId = opts.orgId ?? (await resolveOrgIdForEmail(ownerEmail));
         artifactSecrets = await resolveIntegrationArtifactSecrets(orgId);
         runnableActions = attachToolSearch({ ...actions });
         availableTools = actionsToEngineTools(runnableActions);
@@ -721,7 +733,7 @@ async function processIncomingMessage(incoming, options, opts = {}) {
         startRun(runId, threadId, async (send, signal) => {
             await runWithRequestContext({
                 userEmail: ownerEmail,
-                orgId: orgId ?? undefined,
+                ...requestContext,
                 isIntegrationCaller: true,
                 integration: opts.taskId
                     ? {
@@ -924,6 +936,10 @@ async function processIncomingMessage(incoming, options, opts = {}) {
                         kind: "response-delivery",
                         incoming,
                         message: outgoing,
+                        principalType: opts.principalType ?? "user",
+                        ...(requestScope.orgScope
+                            ? { orgScope: requestScope.orgScope }
+                            : {}),
                         ...(progress?.responseTargetRef
                             ? {
                                 placeholderRef: progress.responseTargetRef,
@@ -1150,6 +1166,10 @@ async function processIncomingMessage(incoming, options, opts = {}) {
                                 kind: "response-delivery",
                                 incoming,
                                 message: outgoingForDelivery,
+                                principalType: opts.principalType ?? "user",
+                                ...(requestScope.orgScope
+                                    ? { orgScope: requestScope.orgScope }
+                                    : {}),
                                 internalThreadId: threadId,
                             }),
                             ...(threadCheckpoint?.userMessageId

package/dist/jobs/background-automation-runner.d.ts

@@ -122,6 +122,8 @@ export declare function runBackgroundAutomation(options: BackgroundAutomationRun
 export declare function checkBackgroundAutomationCredentials(identity: {
     ownerEmail: string;
     orgId?: string;
+    orgScope?: "personal";
+    defaultAgentEngineScope?: "deployment";
 }, deps: BackgroundAutomationDeps, automationModel?: string): Promise<{
     ok: true;
     engine: AgentEngine;

package/dist/jobs/background-automation-runner.js

@@ -16,7 +16,7 @@ import { withDbExec } from "../db/client.js";
 import { automationOutcomeMessagesForUser } from "../localization/automation-outcome-messages.js";
 import { automationRecoveryMessagesForLocale } from "../localization/automation-recovery-messages.js";
 import { queryOrgMembers } from "../org/context.js";
-import { organizationIdFromResourceOwner, } from "../resources/store.js";
+import { organizationIdFromResourceOwner, SHARED_OWNER, } from "../resources/store.js";
 import { captureError } from "../server/capture-error.js";
 import { BuilderCredentialLookupError, CredentialStoreUnavailableError, } from "../server/credential-provider.js";
 import { runWithRequestContext, } from "../server/request-context.js";
@@ -146,6 +146,17 @@ export async function resolveBackgroundAutomationIdentity(automation) {
     const orgId = recoveredFactoryOwnerOrgId(automation.meta, automation.resource.path, automation.resource.owner) ??
         automation.meta.orgId ??
         undefined;
+    if (!orgId &&
+        automation.resource.owner !== "__shared__" &&
+        !organizationIdFromResourceOwner(automation.resource.owner)) {
+        const resolved = await resolveAutomationExecutionIdentity(automation.resource.owner, automation.meta);
+        if (!resolved.ok)
+            return resolved;
+        const validity = await validateAutomationRunIdentity(resolved.identity.userEmail);
+        if (!validity.ok)
+            return validity;
+        return resolved;
+    }
     const validity = await validateAutomationRunIdentity(userEmail, orgId);
     return validity.ok
         ? {
@@ -153,6 +164,9 @@ export async function resolveBackgroundAutomationIdentity(automation) {
             identity: {
                 userEmail,
                 orgId,
+                ...(!orgId && automation.resource.owner === SHARED_OWNER
+                    ? { defaultAgentEngineScope: "deployment" }
+                    : {}),
                 eventOwner: userEmail.toLowerCase(),
             },
         }
@@ -555,7 +569,16 @@ async function resolveBackgroundAutomationModel(engine, automationModel, deps) {
  */
 export async function checkBackgroundAutomationCredentials(identity, deps, automationModel) {
     try {
-        const { engine, model } = await runWithRequestContext({ userEmail: identity.ownerEmail, orgId: identity.orgId }, async () => {
+        const { engine, model } = await runWithRequestContext({
+            userEmail: identity.ownerEmail,
+            orgId: identity.orgId,
+            ...(identity.orgScope === "personal"
+                ? { orgScope: "personal" }
+                : {}),
+            ...(identity.defaultAgentEngineScope === "deployment"
+                ? { defaultAgentEngineScope: "deployment" }
+                : {}),
+        }, async () => {
             const engine = await resolveUsableBackgroundEngine(identity, deps, () => undefined);
             const model = await resolveBackgroundAutomationModel(engine, automationModel, deps);
             return { engine, model };