@agent-native/core 0.227.0 → 0.228.0-nightly-20261111004142

package/dist/review/suggestions/actions.js

@@ -2,9 +2,9 @@ import { z } from "zod";
 import { defineAction, fail } from "../../action.js";
 import { getDbExec } from "../../db/client.js";
 import { notifyReviewComment } from "../notifications.js";
-import { assertReviewableResourceAccess } from "../registry.js";
+import { assertReviewableResourceAccess, REVIEW_SUGGESTION_ANCHOR_KIND, reviewSuggestionAuthorRole, } from "../registry.js";
 import { ensureReviewTables, insertReviewCommentWithClient, resolveReviewThreadWithClient, } from "../store.js";
-import { suggestionActorKind, suggestionActorKindMatchesReceipt, } from "./actor-kind.js";
+import { suggestionActorKind, suggestionActorKindMatchesReceipt, suggestionAuthorClient, suggestionAuthorSource, } from "./actor-kind.js";
 import { getSuggestionAdapter } from "./registry.js";
 import { getSuggestion, getSuggestions, ensureSuggestionTables, insertSuggestion, listSuggestions, recordDecision, getDecision, getSuggestionByCreationKey, recordSuggestionCreation, updateSuggestionStatus, getSuggestionAmendment, amendSuggestion, deleteUnclaimedSuggestion, getSuggestionProposal, insertSuggestionProposal, getProposalCreation, recordProposalCreation, getProposalDecision, recordProposalDecision, } from "./store.js";
 const base = { resourceType: z.string().min(1), resourceId: z.string().min(1) };
@@ -108,6 +108,20 @@ async function supersedeSuggestions(tx, args, authorEmail, replacementId) {
         await resolveReviewThreadWithClient(tx, prior.threadId, authorEmail, { resourceType: prior.resourceType, resourceId: prior.resourceId }, "superseded");
     }
 }
+// So a suggestion's change event reaches everyone who can read the resource,
+// not only the actor: their open page shows it without a reload.
+function suggestionChangeResource(suggestion) {
+    return suggestion
+        ? {
+            resourceType: suggestion.resourceType,
+            resourceId: suggestion.resourceId,
+        }
+        : null;
+}
+// A failed call reaches changeResource with no result, whatever its type says.
+function decisionChangeResource(result) {
+    return suggestionChangeResource(result?.suggestion ?? result?.suggestions?.[0]);
+}
 export const createResourceSuggestion = defineAction({
     description: "Create a typed pending suggestion without changing the canonical resource. Pass supersedes to replace your own earlier pending suggestions on the same resource in the same step.",
     schema: z.object({
@@ -135,8 +149,12 @@ export const createResourceSuggestion = defineAction({
         openWorldHint: true,
         idempotentHint: true,
     },
+    changeResource: ({ resourceType, resourceId }) => ({
+        resourceType,
+        resourceId,
+    }),
     run: async (args, ctx) => {
-        const access = await assertReviewableResourceAccess(args.resourceType, args.resourceId, ctx, "commenter");
+        const access = await assertReviewableResourceAccess(args.resourceType, args.resourceId, ctx, reviewSuggestionAuthorRole(args.resourceType));
         const adapter = getSuggestionAdapter(args.adapterKind);
         if (!adapter)
             throw new Error("Suggestion adapter not registered");
@@ -172,6 +190,8 @@ export const createResourceSuggestion = defineAction({
                 threadId: `suggestion-thread-${globalThis.crypto.randomUUID()}`,
                 authorEmail,
                 actorKind,
+                authorSource: suggestionAuthorSource(ctx),
+                authorClient: suggestionAuthorClient(ctx),
                 baseRevision: args.baseRevision,
                 status: "pending",
                 summary: args.summary,
@@ -197,6 +217,7 @@ export const createResourceSuggestion = defineAction({
                 targetId: created.id,
                 kind: "correction",
                 anchor: created.operations.map((item) => item.anchor ?? null),
+                anchorKind: REVIEW_SUGGESTION_ANCHOR_KIND,
                 body: created.summary,
                 authorEmail: created.authorEmail,
                 createdBy: actorKind,
@@ -261,7 +282,7 @@ export const updateResourceSuggestion = defineAction({
         const initial = await getSuggestion(args.id);
         if (!initial)
             fail("Suggestion not found", { statusCode: 404, errorCode: "not_found" });
-        await assertReviewableResourceAccess(initial.resourceType, initial.resourceId, ctx, "commenter");
+        await assertReviewableResourceAccess(initial.resourceType, initial.resourceId, ctx, reviewSuggestionAuthorRole(initial.resourceType));
         const author = ctx?.userEmail;
         if (!author || author !== initial.authorEmail) {
             fail("Only the author can amend this suggestion", {
@@ -285,7 +306,7 @@ export const updateResourceSuggestion = defineAction({
                     statusCode: 404,
                     errorCode: "not_found",
                 });
-            const access = await assertReviewableResourceAccess(current.resourceType, current.resourceId, { ...ctx, transaction: tx }, "commenter");
+            const access = await assertReviewableResourceAccess(current.resourceType, current.resourceId, { ...ctx, transaction: tx }, reviewSuggestionAuthorRole(current.resourceType));
             if (current.authorEmail !== author)
                 fail("Only the author can amend this suggestion", {
                     statusCode: 403,
@@ -339,6 +360,7 @@ export const updateResourceSuggestion = defineAction({
             };
         },
     },
+    changeResource: (_input, result) => suggestionChangeResource(result),
 });
 export const listResourceSuggestions = defineAction({
     description: "List typed suggestions for a resource.",
@@ -394,7 +416,7 @@ function decisionAccessRole(suggestion, decision, ctx) {
             errorCode: "forbidden",
         });
     }
-    return "commenter";
+    return reviewSuggestionAuthorRole(suggestion.resourceType);
 }
 export const decideResourceSuggestion = defineAction({
     description: "Accept or reject a pending suggestion atomically, which needs edit access. An accept that can no longer be placed on the current resource fails with 409 `suggestion_stale`, changes nothing, and leaves the suggestion pending. Its author may instead withdraw it with comment access; a withdrawn suggestion was never reviewed and leaves the resource unchanged.",
@@ -551,6 +573,7 @@ export const decideResourceSuggestion = defineAction({
                 : undefined;
         },
     },
+    changeResource: (_input, result) => decisionChangeResource(result),
 });
 const proposalCreationSchema = z.object({
     ...base,
@@ -611,8 +634,12 @@ export const createResourceSuggestionProposal = defineAction({
         openWorldHint: true,
         idempotentHint: true,
     },
+    changeResource: ({ resourceType, resourceId }) => ({
+        resourceType,
+        resourceId,
+    }),
     run: async (args, ctx) => {
-        await assertReviewableResourceAccess(args.resourceType, args.resourceId, ctx, "commenter");
+        await assertReviewableResourceAccess(args.resourceType, args.resourceId, ctx, reviewSuggestionAuthorRole(args.resourceType));
         const adapter = getSuggestionAdapter(args.adapterKind);
         if (!adapter)
             throw new Error("Suggestion adapter not registered");
@@ -634,7 +661,7 @@ export const createResourceSuggestionProposal = defineAction({
         if (!db.transaction)
             throw new Error("Proposal creation requires an atomic database transaction");
         const replay = async (tx, prior) => {
-            await assertReviewableResourceAccess(args.resourceType, args.resourceId, { ...ctx, transaction: tx }, "commenter");
+            await assertReviewableResourceAccess(args.resourceType, args.resourceId, { ...ctx, transaction: tx }, reviewSuggestionAuthorRole(args.resourceType));
             if (prior.requestHash !== requestHash ||
                 prior.authorEmail !== authorEmail ||
                 prior.actorKind !== actorKind) {
@@ -664,7 +691,7 @@ export const createResourceSuggestionProposal = defineAction({
             const prior = await getProposalCreation(tx, args.idempotencyKey);
             if (prior)
                 return replay(tx, prior);
-            const access = await assertReviewableResourceAccess(args.resourceType, args.resourceId, { ...ctx, transaction: tx }, "commenter");
+            const access = await assertReviewableResourceAccess(args.resourceType, args.resourceId, { ...ctx, transaction: tx }, reviewSuggestionAuthorRole(args.resourceType));
             const proposal = args.proposalId
                 ? await getSuggestionProposal(tx, args.proposalId)
                 : await insertSuggestionProposal(tx, {
@@ -675,11 +702,35 @@ export const createResourceSuggestionProposal = defineAction({
                     authorEmail,
                     actorKind,
                 });
-            if (!proposal)
+            if (!proposal) {
+                // A first call returns both a suggestion ID and a proposal ID, and
+                // agents appending a second edit often pass the suggestion's. Name
+                // the proposal when that suggestion is the caller's own, on this
+                // same resource: only its author can append to it.
+                const suggestion = args.proposalId
+                    ? await getSuggestion(args.proposalId, tx)
+                    : null;
+                if (suggestion &&
+                    suggestion.resourceType === args.resourceType &&
+                    suggestion.resourceId === args.resourceId &&
+                    suggestion.authorEmail === authorEmail &&
+                    suggestion.actorKind === actorKind) {
+                    fail(suggestion.proposalId
+                        ? `${suggestion.id} is a suggestion ID, not a proposal ID. To add this edit to the same review, pass its proposal ID: ${suggestion.proposalId}.`
+                        : `${suggestion.id} is a suggestion ID, not a proposal ID, and it belongs to no proposal. Leave the proposal ID out to start a new review.`, {
+                        statusCode: 400,
+                        errorCode: "suggestion_id_not_proposal_id",
+                        details: {
+                            suggestionId: suggestion.id,
+                            proposalId: suggestion.proposalId ?? null,
+                        },
+                    });
+                }
                 fail("Proposal not found", {
                     statusCode: 404,
                     errorCode: "not_found",
                 });
+            }
             if (proposal.resourceType !== args.resourceType ||
                 proposal.resourceId !== args.resourceId ||
                 proposal.adapterKind !== args.adapterKind ||
@@ -716,6 +767,8 @@ export const createResourceSuggestionProposal = defineAction({
                     threadId: `suggestion-thread-${globalThis.crypto.randomUUID()}`,
                     authorEmail,
                     actorKind,
+                    authorSource: suggestionAuthorSource(ctx),
+                    authorClient: suggestionAuthorClient(ctx),
                     baseRevision: args.baseRevision,
                     status: "pending",
                     summary: item.summary,
@@ -733,6 +786,7 @@ export const createResourceSuggestionProposal = defineAction({
                     targetId: created.id,
                     kind: "correction",
                     anchor: created.operations.map((part) => part.anchor ?? null),
+                    anchorKind: REVIEW_SUGGESTION_ANCHOR_KIND,
                     body: created.summary,
                     authorEmail,
                     createdBy: actorKind,
@@ -998,4 +1052,5 @@ export const decideResourceSuggestionProposal = defineAction({
                 : undefined;
         },
     },
+    changeResource: (_input, result) => decisionChangeResource(result),
 });

package/dist/review/suggestions/actor-kind.d.ts

@@ -1,3 +1,8 @@
+import type { SuggestionAuthorSource } from "./types.js";
 export declare function suggestionActorKind(ctx: unknown): "agent" | "human" | "system";
+/** How an agent's call arrived, or null for a person's. */
+export declare function suggestionAuthorSource(ctx: unknown): SuggestionAuthorSource | null;
+/** The MCP host an MCP call's client said it was, such as `claude-code`. */
+export declare function suggestionAuthorClient(ctx: unknown): string | null;
 export declare const LEGACY_SUGGESTION_RECEIPT_VERSION = 1;
 export declare function suggestionActorKindMatchesReceipt(receiptActorKind: string | null | undefined, actorKind: string, receiptVersion: number | null | undefined): boolean;

package/dist/review/suggestions/actor-kind.js

@@ -1,3 +1,4 @@
+import { resolveMcpClientHostId } from "../../shared/mcp-connect-content.js";
 export function suggestionActorKind(ctx) {
     const agentCallers = new Set(["agent", "tool", "mcp", "webmcp", "a2a"]);
     const caller = ctx?.caller;
@@ -5,6 +6,25 @@ export function suggestionActorKind(ctx) {
         return "agent";
     return ctx?.userEmail ? "human" : "system";
 }
+/** How an agent's call arrived, or null for a person's. */
+export function suggestionAuthorSource(ctx) {
+    const caller = ctx?.caller;
+    if (caller === "mcp" || caller === "webmcp")
+        return "mcp";
+    if (caller === "a2a")
+        return "a2a";
+    if (caller === "agent" || caller === "tool")
+        return "agent";
+    return null;
+}
+/** The MCP host an MCP call's client said it was, such as `claude-code`. */
+export function suggestionAuthorClient(ctx) {
+    if (suggestionAuthorSource(ctx) !== "mcp")
+        return null;
+    // An MCP caller means ctx is a context object.
+    const client = ctx.mcpClient;
+    return resolveMcpClientHostId(client) ?? null;
+}
 export const LEGACY_SUGGESTION_RECEIPT_VERSION = 1;
 export function suggestionActorKindMatchesReceipt(receiptActorKind, actorKind, receiptVersion) {
     if (receiptActorKind === actorKind)

package/dist/review/suggestions/store.js

@@ -69,6 +69,14 @@ export const reviewSuggestionsStore = defineStore({
                 await exec.execute("CREATE INDEX IF NOT EXISTS idx_review_suggestion_proposal_members ON agent_review_suggestions (proposal_id, created_at)");
             },
         },
+        {
+            name: "author-source-and-client",
+            run: async () => {
+                for (const column of ["author_source", "author_client"]) {
+                    await ensureColumnExists("agent_review_suggestions", column, `ALTER TABLE agent_review_suggestions ADD COLUMN IF NOT EXISTS ${column} TEXT`);
+                }
+            },
+        },
     ],
 });
 export function ensureSuggestionTables(client = getDbExec()) {
@@ -143,7 +151,7 @@ export async function insertSuggestion(input, client = getDbExec()) {
     const suggestionId = `suggestion-${newId()}`;
     const now = new Date().toISOString();
     await client.execute({
-        sql: "INSERT INTO agent_review_suggestions (id,resource_type,resource_id,adapter_kind,adapter_version,thread_id,author_email,actor_kind,base_revision,status,summary,owner_email,org_id,visibility,created_at,updated_at,metadata_json,proposal_id) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
+        sql: "INSERT INTO agent_review_suggestions (id,resource_type,resource_id,adapter_kind,adapter_version,thread_id,author_email,actor_kind,author_source,author_client,base_revision,status,summary,owner_email,org_id,visibility,created_at,updated_at,metadata_json,proposal_id) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
         args: [
             suggestionId,
             input.resourceType,
@@ -153,6 +161,8 @@ export async function insertSuggestion(input, client = getDbExec()) {
             input.threadId,
             input.authorEmail,
             input.actorKind,
+            input.authorSource ?? null,
+            input.authorClient ?? null,
             input.baseRevision,
             input.status,
             input.summary,
@@ -307,6 +317,9 @@ function suggestionFromRows(row, operationRows) {
         threadId: String(row.thread_id),
         authorEmail: row.author_email,
         actorKind: row.actor_kind,
+        authorSource: (row.author_source ??
+            null),
+        authorClient: (row.author_client ?? null),
         baseRevision: String(row.base_revision),
         status: row.status,
         summary: String(row.summary),
@@ -336,8 +349,9 @@ export async function listSuggestions(resourceType, resourceId, statuses, client
         ? ` AND s.status IN (${statuses.map(() => "?").join(",")})`
         : "";
     args.push(...(statuses ?? []));
+    // raw-sql-ok: the filter adds only ? placeholders, one per bound status.
     const rows = (await client.execute({
-        sql: `SELECT s.id AS suggestion_id,s.proposal_id,p.summary AS proposal_summary,s.revision,s.resource_type,s.resource_id,s.adapter_kind,s.adapter_version,s.thread_id,s.author_email,s.actor_kind,s.base_revision,s.status,s.summary,s.owner_email,s.org_id,s.visibility,s.created_at,s.updated_at,s.metadata_json,o.id AS operation_id,o.ordinal AS operation_ordinal,o.operation_kind,o.target_id,o.before_json,o.after_json,o.anchor_json,o.dependencies_json,o.schema_version FROM agent_review_suggestions s LEFT JOIN agent_review_suggestion_proposals p ON p.id = s.proposal_id LEFT JOIN agent_review_suggestion_operations o ON o.suggestion_id = s.id WHERE s.resource_type = ? AND s.resource_id = ?${filter} ORDER BY s.created_at,o.ordinal`,
+        sql: `SELECT s.id AS suggestion_id,s.proposal_id,p.summary AS proposal_summary,s.revision,s.resource_type,s.resource_id,s.adapter_kind,s.adapter_version,s.thread_id,s.author_email,s.actor_kind,s.author_source,s.author_client,s.base_revision,s.status,s.summary,s.owner_email,s.org_id,s.visibility,s.created_at,s.updated_at,s.metadata_json,o.id AS operation_id,o.ordinal AS operation_ordinal,o.operation_kind,o.target_id,o.before_json,o.after_json,o.anchor_json,o.dependencies_json,o.schema_version FROM agent_review_suggestions s LEFT JOIN agent_review_suggestion_proposals p ON p.id = s.proposal_id LEFT JOIN agent_review_suggestion_operations o ON o.suggestion_id = s.id WHERE s.resource_type = ? AND s.resource_id = ?${filter} ORDER BY s.created_at,o.ordinal`,
         args,
     })).rows;
     const grouped = new Map();

package/dist/review/suggestions/types.d.ts

@@ -1,6 +1,7 @@
 import type { Visibility } from "../../sharing/schema.js";
 export type SuggestionStatus = "pending" | "accepted" | "rejected" | "stale" | "superseded" | "withdrawn";
 export type SuggestionDecision = "accepted" | "rejected";
+export type SuggestionAuthorSource = "mcp" | "a2a" | "agent";
 export interface SuggestionOperation {
     id?: string;
     ordinal: number;
@@ -24,6 +25,18 @@ export interface ResourceSuggestion {
     threadId: string;
     authorEmail: string | null;
     actorKind: "human" | "agent" | "system";
+    /**
+     * How an agent's suggestion arrived: over MCP, from another app's agent
+     * (`a2a`), or from the app's own agent. Null for people and for
+     * suggestions made before it was recorded.
+     */
+    authorSource?: SuggestionAuthorSource | null;
+    /**
+     * The MCP host the agent's client said it was, as a connect host id such as
+     * `claude-code` (see `mcpConnectHostLabel`). Null when the client named no
+     * host this app knows.
+     */
+    authorClient?: string | null;
     baseRevision: string;
     status: SuggestionStatus;
     summary: string;

package/dist/review/types.d.ts

@@ -1,3 +1,4 @@
+import type { DbExec } from "../db/client.js";
 import type { Visibility } from "../sharing/schema.js";
 export type ReviewResourceRole = "viewer" | "commenter" | "editor" | "admin" | "owner";
 export type ReviewCommentKind = "comment" | "annotation" | "correction" | "question" | "decision" | "review";
@@ -24,6 +25,77 @@ export interface ReviewableResourceRegistration {
     displayName?: string;
     resolveUrl?: (resourceId: string) => Promise<string | null | undefined> | string | null | undefined;
     resolveAccess?: (resourceId: string, ctx?: ReviewResourceContext) => Promise<ReviewResourceAccess | null> | ReviewResourceAccess | null;
+    /** Who may comment, and where a new thread goes. */
+    comments?: ReviewCommentPolicy;
+    /**
+     * What a comment can attach to, by anchor kind. Once a resource declares
+     * any, every anchored comment on it names one, and its anchor must pass that
+     * kind's check before anything is written.
+     */
+    anchorKinds?: Record<string, ReviewAnchorKind>;
+    /**
+     * Runs inside the same database transaction as each comment write, with
+     * that transaction's handle. Throwing refuses the write. Use the handle for
+     * any database work here: `getDbExec()` would run on another connection.
+     */
+    onCommentWrite?: (event: ReviewCommentWriteEvent, tx: DbExec) => Promise<void> | void;
+}
+export interface ReviewCommentPolicy {
+    /**
+     * The lowest role that may comment, reply and react, and edit or delete
+     * their own comments. Defaults to `commenter`.
+     */
+    minimumRole?: ReviewResourceRole;
+    /**
+     * Where a new thread that mentions no one goes: the agent (the default) or
+     * people. A thread with a mention always goes to people.
+     */
+    unmentionedRoute?: ReviewResolutionTarget;
+}
+export interface ReviewAnchorKind {
+    /** The version new anchors of this kind are written at. */
+    version: number;
+    /**
+     * Checks an anchor written at `version` and returns it as it's stored.
+     * Throw to refuse a malformed anchor; nothing is written.
+     */
+    parse: (anchor: unknown, version: number) => unknown;
+}
+/** A comment write, as a resource's `onCommentWrite` hook sees it. */
+export type ReviewCommentWriteEvent = {
+    type: "created";
+    comment: ReviewComment;
+} | {
+    type: "edited" | "anchor-moved";
+    comment: ReviewComment;
+    /** Who changed it, which for an editor moving a pin isn't the author. */
+    actorEmail: string | null;
+} | {
+    type: "resolved" | "reopened";
+    resourceType: string;
+    resourceId: string;
+    threadId: string;
+    actorEmail: string | null;
+} | {
+    type: "deleted";
+    resourceType: string;
+    resourceId: string;
+    threadId: string;
+    /** The comment deleted and, for a thread's first comment, the rest. */
+    commentIds: string[];
+    actorEmail: string | null;
+};
+/** A comment's link to the same comment or thread in another system. */
+export interface ReviewCommentLink {
+    /** The other system, such as `notion`. */
+    provider: string;
+    /** What the outside ID names there, such as `comment` or `discussion`. */
+    externalKind: string;
+    externalId: string;
+    commentId: string;
+    resourceType: string;
+    resourceId: string;
+    createdAt: string;
 }
 export interface ReviewMention {
     label: string;
@@ -52,9 +124,26 @@ export interface ReviewComment {
     threadId: string;
     parentCommentId: string | null;
     targetId: string | null;
+    /**
+     * The part of the resource the thread sits on, such as a slide. The kit
+     * always returns this and the anchor and revision fields below; they're
+     * optional so comments built elsewhere, such as optimistic ones, needn't.
+     */
+    surfaceId?: string | null;
     kind: ReviewCommentKind;
     status: ReviewCommentStatus;
     anchor: unknown;
+    /** The anchor's kind and the version it was written at, when typed. */
+    anchorKind?: string | null;
+    anchorVersion?: number | null;
+    /**
+     * Goes up whenever this comment changes: its text, anchor, status or
+     * deletion, and on a thread's first comment, which holds the thread's
+     * routing, its routing and agent pickup. So a write can check nothing
+     * changed under it. Notification bookkeeping leaves it alone, so a new
+     * comment's author can edit it at the revision they got back.
+     */
+    revision?: number;
     body: string;
     authorEmail: string | null;
     authorName: string | null;

package/dist/scripts/db/dev-query-proxy.d.ts

@@ -5,6 +5,8 @@ export interface TryForwardDbQueryOptions {
     format?: string;
     userEmail?: string;
     orgId?: string;
+    /** The caller acts in no org; the dev server must not look one up. */
+    orgScope?: "personal";
     print: (rows: Record<string, unknown>[], sql: string, format?: string) => void;
 }
 export declare function tryForwardDbQueryToDevServer(options: TryForwardDbQueryOptions): Promise<boolean>;

package/dist/scripts/db/dev-query-proxy.js

@@ -1,5 +1,5 @@
 import { Agent } from "undici";
-import { DEV_ACTION_ORG_HEADER, DEV_ACTION_TOKEN_HEADER, DEV_ACTION_USER_HEADER, DEV_DB_QUERY_ROUTE, } from "../../server/dev-action-bridge.js";
+import { DEV_ACTION_ORG_HEADER, DEV_ACTION_ORG_SCOPE_HEADER, DEV_ACTION_TOKEN_HEADER, DEV_ACTION_USER_HEADER, DEV_DB_QUERY_ROUTE, } from "../../server/dev-action-bridge.js";
 import { discoverPgliteDevServer } from "./dev-server-discovery.js";
 export async function tryForwardDbQueryToDevServer(options) {
     const discovery = discoverPgliteDevServer();
@@ -23,6 +23,9 @@ export async function tryForwardDbQueryToDevServer(options) {
                     ? { [DEV_ACTION_USER_HEADER]: options.userEmail }
                     : {}),
                 ...(options.orgId ? { [DEV_ACTION_ORG_HEADER]: options.orgId } : {}),
+                ...(options.orgScope === "personal"
+                    ? { [DEV_ACTION_ORG_SCOPE_HEADER]: "personal" }
+                    : {}),
             },
             body: JSON.stringify({
                 sql: options.sql,

package/dist/scripts/db/query.js

@@ -125,6 +125,9 @@ Options:
             format: parsed.format,
             userEmail: getRequestUserEmail(),
             orgId: getRequestOrgId() ?? undefined,
+            // The CLI already resolved this call's org; with none, it is personal,
+            // so the dev server must not look one up again.
+            ...(getRequestOrgId() ? {} : { orgScope: "personal" }),
             print: printTable,
         });
         if (forwarded)

package/dist/scripts/dev/shell.js

@@ -1,6 +1,7 @@
 import { execSync } from "node:child_process";
 import path from "node:path";
 import { getRequestOrgId, getRequestTimezone, getRequestUserEmail, getRequestUserName, hasRequestContext, } from "../../server/request-context.js";
+import { AGENT_ORG_SCOPE_ENV } from "../dev-session.js";
 import { parseArgs } from "../utils.js";
 const MAX_OUTPUT = 50_000;
 const TIMEOUT_MS = 30_000;
@@ -66,6 +67,9 @@ function childProcessEnvForRequest() {
     setOrClearRequestEnv(env, "AGENT_USER_EMAIL", userEmail, requestScoped);
     setOrClearRequestEnv(env, "AGENT_USER_NAME", userName, requestScoped);
     setOrClearRequestEnv(env, "AGENT_ORG_ID", orgId, requestScoped);
+    // A request with no org runs its commands with no org too. Without this, a
+    // `pnpm action` it runs would look up the user's active org instead.
+    setOrClearRequestEnv(env, AGENT_ORG_SCOPE_ENV, requestScoped && !orgId ? "personal" : undefined, requestScoped);
     setOrClearRequestEnv(env, "AGENT_USER_TIMEZONE", timezone, requestScoped);
     return env;
 }

package/dist/scripts/dev-session.d.ts

@@ -7,3 +7,34 @@
  * (sign in via the running app, or set `AGENT_USER_EMAIL`).
  */
 export declare function resolveDevUserEmail(): Promise<string | undefined>;
+/**
+ * Set to "personal" on a child process whose caller acts in no org, so a
+ * `pnpm action` it runs stays out of the user's orgs too. The agent's shell
+ * tool sets it for a request with no org.
+ */
+export declare const AGENT_ORG_SCOPE_ENV = "AGENT_ORG_SCOPE";
+export interface DevOrgChoice {
+    /** An org the caller named: `AGENT_ORG_ID` or a forwarded org header. */
+    orgId?: string | undefined;
+    /** The caller acts in no org and must not be given one. */
+    personal?: boolean | undefined;
+}
+/** The org choice this CLI process inherited from its environment. */
+export declare function devOrgChoiceFromEnv(env?: NodeJS.ProcessEnv): DevOrgChoice;
+/**
+ * Resolve the org scope a local CLI call acts in, for `userEmail`, as fields
+ * for its request context.
+ *
+ * An inherited personal scope wins, then a named org. Otherwise this is the
+ * org the signed-in app uses for the same user: their active org, else their
+ * first membership, or none when they chose their personal space or have no
+ * org. Without it, `pnpm action` ran with no org and saw only the user's
+ * personal rows while the app showed their org's.
+ *
+ * Like the app, a membership table that can't be read counts as no org;
+ * transient database errors still throw.
+ */
+export declare function resolveDevOrgScope(userEmail: string | undefined, choice: DevOrgChoice): Promise<{
+    orgId?: string;
+    orgScope?: "personal";
+}>;

package/dist/scripts/dev-session.js

@@ -52,3 +52,61 @@ export async function resolveDevUserEmail() {
         return undefined;
     }
 }
+/**
+ * Set to "personal" on a child process whose caller acts in no org, so a
+ * `pnpm action` it runs stays out of the user's orgs too. The agent's shell
+ * tool sets it for a request with no org.
+ */
+export const AGENT_ORG_SCOPE_ENV = "AGENT_ORG_SCOPE";
+/** The org choice this CLI process inherited from its environment. */
+export function devOrgChoiceFromEnv(env = process.env) {
+    return {
+        orgId: env.AGENT_ORG_ID || undefined,
+        personal: env[AGENT_ORG_SCOPE_ENV] === "personal",
+    };
+}
+/**
+ * Resolve the org scope a local CLI call acts in, for `userEmail`, as fields
+ * for its request context.
+ *
+ * An inherited personal scope wins, then a named org. Otherwise this is the
+ * org the signed-in app uses for the same user: their active org, else their
+ * first membership, or none when they chose their personal space or have no
+ * org. Without it, `pnpm action` ran with no org and saw only the user's
+ * personal rows while the app showed their org's.
+ *
+ * Like the app, a membership table that can't be read counts as no org;
+ * transient database errors still throw.
+ */
+export async function resolveDevOrgScope(userEmail, choice) {
+    // Personal comes first. Only the agent's shell sets it, for a request with
+    // no org, and the child's own env loading can put an AGENT_ORG_ID from
+    // `.env` back, which must not give the command an org.
+    if (choice.personal)
+        return { orgScope: "personal" };
+    if (choice.orgId)
+        return { orgId: choice.orgId };
+    if (!userEmail)
+        return {};
+    if (await localDatabaseIsMissing())
+        return {};
+    const { resolveOrgIdForEmail } = await import("../org/context.js");
+    const orgId = await resolveOrgIdForEmail(userEmail);
+    return orgId ? { orgId } : {};
+}
+/**
+ * True when the app's local PGlite database hasn't been created yet. It has
+ * no orgs, and opening it to look would create it and run every migration,
+ * which takes many seconds for an action that may not touch the database.
+ */
+async function localDatabaseIsMissing() {
+    const { getRuntimeDatabaseUrl, isPgliteUrl, pgliteDataDirFromUrl, pgliteRuntimeDataDir, } = await import("../db/client.js");
+    const url = getRuntimeDatabaseUrl("pglite:./data/pglite");
+    if (!isPgliteUrl(url))
+        return false;
+    const dataDir = pgliteRuntimeDataDir(pgliteDataDirFromUrl(url));
+    if (dataDir === "memory://")
+        return false;
+    const fs = await import("node:fs");
+    return !fs.existsSync(dataDir);
+}