@agent-native/core 0.227.0 → 0.228.0-nightly-20261111004142

package/dist/scripts/resources/list.js

@@ -1,6 +1,8 @@
 import { resourceList, resourceListAccessible, ensurePersonalDefaults, isWorkspaceResourceOwner, SHARED_OWNER, WORKSPACE_OWNER, sharedResourceOwner, } from "../../resources/store.js";
 import { getAmbientUserEmail, getRequestOrgId, getRequestUserEmail, } from "../../server/request-context.js";
 import { parseArgs, fail } from "../utils.js";
+const DEFAULT_PAGE_SIZE = 50;
+const MAX_PAGE_SIZE = 100;
 export default async function resourceListScript(args) {
     const parsed = parseArgs(args);
     if (parsed.help === "true") {
@@ -12,9 +14,23 @@ Options:
                                Scope to list (default: all)
   --format json|text           Output format (default: text)
   --include-agent-scratch true Include hidden agent scratch files
+  --limit <n>                  Resources per page, 1-${MAX_PAGE_SIZE} (default: ${DEFAULT_PAGE_SIZE}).
+                               Text output always pages; json pages only
+                               when --limit or --offset is set
+  --offset <n>                 Resources to skip; pass the previous page's
+                               next offset
   --help                       Show this help message`);
         return;
     }
+    const limitArg = parsed.limit;
+    const offsetArg = parsed.offset;
+    if (limitArg !== undefined &&
+        !(/^\d+$/.test(limitArg) && +limitArg >= 1 && +limitArg <= MAX_PAGE_SIZE)) {
+        fail(`--limit must be a whole number from 1 to ${MAX_PAGE_SIZE}`);
+    }
+    if (offsetArg !== undefined && !/^\d+$/.test(offsetArg)) {
+        fail("--offset must be a whole number, 0 or more");
+    }
     const prefix = parsed.prefix;
     const scope = parsed.scope ?? "all";
     const format = parsed.format ?? "text";
@@ -72,16 +88,44 @@ Options:
             })
             : await resourceListAccessible(owner, prefix, { orgId });
     }
+    // Agents read this through tool-result caps (12,000 chars when replayed), so
+    // text always pages and json pages when asked. Sorting the merged list keeps
+    // pages stable across calls.
+    resources.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    const paged = format !== "json" || limitArg !== undefined || offsetArg !== undefined;
+    const total = resources.length;
+    const offset = Number(offsetArg ?? 0);
+    const limit = Number(limitArg ?? DEFAULT_PAGE_SIZE);
+    const page = paged ? resources.slice(offset, offset + limit) : resources;
+    const nextOffset = offset + page.length < total ? offset + page.length : null;
     if (format === "json") {
-        console.log(JSON.stringify(resources, null, 2));
+        console.log(JSON.stringify(paged
+            ? {
+                total,
+                offset,
+                limit,
+                hasMore: nextOffset !== null,
+                nextOffset,
+                resources: page,
+            }
+            : resources, null, 2));
         return;
     }
-    if (resources.length === 0) {
+    if (total === 0) {
         console.log("No resources found.");
         return;
     }
-    console.log(`Resources: ${resources.length}\n`);
-    for (const r of resources) {
+    if (page.length === 0) {
+        console.log(`No resources at offset ${offset} (${total} total).`);
+        return;
+    }
+    // The next offset leads the header too: truncation cuts from the end.
+    const whole = page.length === total;
+    const range = whole
+        ? ""
+        : ` (showing ${offset + 1}-${offset + page.length}${nextOffset === null ? "" : `; next offset=${nextOffset}`})`;
+    console.log(`Resources: ${total}${range}\n`);
+    for (const r of page) {
         const ownerLabel = isWorkspaceResourceOwner(r.owner)
             ? "[workspace]"
             : r.owner === SHARED_OWNER
@@ -90,4 +134,9 @@ Options:
         const sizeLabel = r.size != null ? ` (${r.size} bytes)` : "";
         console.log(`  ${r.path}  ${ownerLabel}${sizeLabel}  ${r.mimeType}`);
     }
+    if (whole)
+        return;
+    console.log(nextOffset === null
+        ? "\nEnd of list."
+        : `\n${total - nextOffset} more not shown. Next page: repeat this call with offset=${nextOffset}.`);
 }

package/dist/scripts/runner.js

@@ -11,11 +11,11 @@ import { requestCliApproval, runApprovedCliAction, takeCliApprovalFlag, } from "
 import { getUrlOpenerCommand } from "../cli/open-url.js";
 import { closeDbExec, getRuntimeDatabaseUrl, isProcessAlive, } from "../db/client.js";
 import { notifyActionChange } from "../server/action-change.js";
-import { DEV_ACTION_ORG_HEADER, DEV_ACTION_ROUTE, DEV_ACTION_TOKEN_HEADER, DEV_ACTION_USER_HEADER, devActionHandoffUrl, hashDatabaseKey, isLoopbackDevActionOrigin, isValidDevActionHandoffUrl, readDevActionDiscoveryFile, } from "../server/dev-action-bridge.js";
+import { DEV_ACTION_ORG_HEADER, DEV_ACTION_ORG_SCOPE_HEADER, DEV_ACTION_ROUTE, DEV_ACTION_TOKEN_HEADER, DEV_ACTION_USER_HEADER, devActionHandoffUrl, hashDatabaseKey, isLoopbackDevActionOrigin, isValidDevActionHandoffUrl, readDevActionDiscoveryFile, } from "../server/dev-action-bridge.js";
 import { runWithRequestContext, getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
 import { loadCliBootstrap } from "./cli-bootstrap.js";
 import { coreScripts, getCoreScriptNames } from "./core-scripts.js";
-import { resolveDevUserEmail } from "./dev-session.js";
+import { devOrgChoiceFromEnv, resolveDevOrgScope, resolveDevUserEmail, } from "./dev-session.js";
 import { loadEnv } from "./utils.js";
 loadEnv();
 const CLI_HANDOFF_KEYS = new Set(["embedStartUrl", "startUrl"]);
@@ -192,8 +192,24 @@ export async function runScript(options = {}) {
     await tryForwardToDevServer(actionName, args);
     await loadCliBootstrap();
     const userEmail = await resolveDevUserEmail();
-    const orgId = process.env.AGENT_ORG_ID || undefined;
-    return runWithRequestContext({ userEmail, orgId }, () => dispatchAction(actionName, args, options));
+    let orgScope;
+    try {
+        orgScope = await resolveDevOrgScope(userEmail, devOrgChoiceFromEnv());
+    }
+    catch (err) {
+        // The lookup can open the database, so a failure closes it and reports
+        // like a failed action rather than leaving an unhandled rejection.
+        await closeDbExec().catch(() => { });
+        console.error(`Action "${actionName}" failed:`, err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+    return runWithRequestContext({ ...(userEmail ? { userEmail } : {}), ...orgScope }, () => dispatchAction(actionName, args, options));
+}
+/** Tells the dev server this call acts in no org, so it looks none up. */
+function devOrgScopeHeader() {
+    return devOrgChoiceFromEnv().personal
+        ? { [DEV_ACTION_ORG_SCOPE_HEADER]: "personal" }
+        : {};
 }
 export async function tryForwardToDevServer(actionName, args) {
     const discovery = readDevActionDiscoveryFile(process.cwd());
@@ -233,6 +249,7 @@ export async function tryForwardToDevServer(actionName, args) {
                 ...(process.env.AGENT_ORG_ID
                     ? { [DEV_ACTION_ORG_HEADER]: process.env.AGENT_ORG_ID }
                     : {}),
+                ...devOrgScopeHeader(),
             },
             body: JSON.stringify({
                 name: actionName,
@@ -263,6 +280,7 @@ export async function tryForwardToDevServer(actionName, args) {
                         ...(process.env.AGENT_ORG_ID
                             ? { [DEV_ACTION_ORG_HEADER]: process.env.AGENT_ORG_ID }
                             : {}),
+                        ...devOrgScopeHeader(),
                     },
                     body: JSON.stringify({
                         name: actionName,

package/dist/search/query.d.ts

@@ -6,11 +6,17 @@
  * Matching, for each term:
  * - titles and summaries match anywhere, including mid-word ("prio" finds
  *   "Task Priorities"), because they're short;
- * - bodies match whole words, every word as a prefix, through the GIN index;
- *   mid-word body matches are deliberately not supported. A phrase needs
- *   its words adjacent, except in a document too long or repetitive for
- *   Postgres to keep every word position, where every word being in one
- *   field is enough.
+ * - bodies match whole words, every word as a prefix; mid-word body matches
+ *   are deliberately not supported. A phrase needs its words adjacent, except
+ *   in a document too long or repetitive for Postgres to keep every word
+ *   position, where every word being in one field is enough.
+ *
+ * The index is read one row per document the app's query allows, not through
+ * its GIN index across the table. The table holds every user's documents, so a
+ * common word would otherwise read most of them, and Postgres will: it doesn't
+ * count what fetching a stored vector costs, so it picks that scan however many
+ * words the query has. Reading only the caller's rows keeps the cost to the
+ * size of their library, and to that of whatever else narrows the query.
  *
  * Ranking reproduces the tiers the browser lane uses
  * (`TITLE_MATCH_TIER` in Content): exact title 5, title prefix 4, title word

package/dist/search/query.js

@@ -6,11 +6,17 @@
  * Matching, for each term:
  * - titles and summaries match anywhere, including mid-word ("prio" finds
  *   "Task Priorities"), because they're short;
- * - bodies match whole words, every word as a prefix, through the GIN index;
- *   mid-word body matches are deliberately not supported. A phrase needs
- *   its words adjacent, except in a document too long or repetitive for
- *   Postgres to keep every word position, where every word being in one
- *   field is enough.
+ * - bodies match whole words, every word as a prefix; mid-word body matches
+ *   are deliberately not supported. A phrase needs its words adjacent, except
+ *   in a document too long or repetitive for Postgres to keep every word
+ *   position, where every word being in one field is enough.
+ *
+ * The index is read one row per document the app's query allows, not through
+ * its GIN index across the table. The table holds every user's documents, so a
+ * common word would otherwise read most of them, and Postgres will: it doesn't
+ * count what fetching a stored vector costs, so it picks that scan however many
+ * words the query has. Reading only the caller's rows keeps the cost to the
+ * size of their library, and to that of whatever else narrows the query.
  *
  * Ranking reproduces the tiers the browser lane uses
  * (`TITLE_MATCH_TIER` in Content): exact title 5, title prefix 4, title word
@@ -23,7 +29,7 @@
  */
 import { and, not, or, sql } from "drizzle-orm";
 import { SEARCH_RESOURCES_TABLE } from "./index-store.js";
-import { anyOfTsquery, isPhraseTerm, normalizeSearchText, termTsquery, } from "./tokenize.js";
+import { allOfTsquery, anyOfTsquery, isPhraseTerm, normalizeSearchText, termTsquery, } from "./tokenize.js";
 const ALIAS = "search_index";
 /** The indexer's weights for title, summary, and body. */
 const FIELD_WEIGHTS = ["A", "B", "C"];
@@ -61,8 +67,11 @@ export function indexedSearchSql(options) {
     const titleOnlyField = options.fields === "title";
     const needle = (term) => normalizeSearchText(term.text);
     const bodyTerms = (terms) => titleOnlyField ? [] : terms.filter((term) => !term.titleOnly);
+    const docVector = sql.raw(`${ALIAS}.doc_vector`);
+    const positionsComplete = sql.raw(`${ALIAS}.positions_complete`);
+    const termsTsquery = (terms) => anyOfTsquery(terms.map((term) => termTsquery(term.text, { prefix: true })));
     const bodyMatch = (terms) => {
-        const tsquery = anyOfTsquery(terms.map((term) => termTsquery(term.text, { prefix: true })));
+        const tsquery = termsTsquery(terms);
         if (!tsquery)
             return undefined;
         // A document whose vector lost positions can't be phrase-matched
@@ -70,10 +79,9 @@ export function indexedSearchSql(options) {
         const anyOrder = anyOfTsquery(terms
             .filter((term) => isPhraseTerm(term.text))
             .flatMap((term) => FIELD_WEIGHTS.map((weights) => termTsquery(term.text, { prefix: true, anyOrder: true, weights }))));
-        const vectorMatch = anyOrder
-            ? sql `(doc_vector @@ ${tsquery}::tsquery OR (NOT positions_complete AND doc_vector @@ ${anyOrder}::tsquery))`
-            : sql `doc_vector @@ ${tsquery}::tsquery`;
-        return sql `${sql.raw(`${ALIAS}.resource_id`)} IN (SELECT resource_id FROM ${sql.raw(SEARCH_RESOURCES_TABLE)} WHERE app = ${registration.app} AND resource_type = ${registration.type} AND ${vectorMatch})`;
+        return anyOrder
+            ? sql `(${docVector} @@ ${tsquery}::tsquery OR (NOT ${positionsComplete} AND ${docVector} @@ ${anyOrder}::tsquery))`
+            : sql `${docVector} @@ ${tsquery}::tsquery`;
     };
     const titleAny = (terms) => or(...terms.map((term) => contains(titleNorm, needle(term))));
     const summaryAny = (terms) => {
@@ -84,8 +92,35 @@ export function indexedSearchSql(options) {
     };
     const anyField = (terms) => or(titleAny(terms), summaryAny(terms), bodyMatch(bodyTerms(terms)));
     const groups = query.groups.filter((group) => group.terms.length > 0);
+    /**
+     * Every group matching in any field, for groups of plain words. Each test of
+     * a stored vector reads it again, so asking for all the groups in one test
+     * reads each row's vector once. What that misses is a document where some
+     * group matches only in its title or summary, and only those few are tested
+     * group by group.
+     */
+    const everyPlainWordMatch = () => {
+        if (titleOnlyField || groups.length < 2)
+            return undefined;
+        const tested = [];
+        for (const group of groups) {
+            const terms = bodyTerms(group.terms);
+            const tsquery = termsTsquery(terms);
+            if (!tsquery || terms.some((term) => isPhraseTerm(term.text))) {
+                return undefined;
+            }
+            tested.push({ terms: group.terms, tsquery });
+        }
+        return or(sql `${docVector} @@ ${allOfTsquery(tested.map((group) => group.tsquery))}::tsquery`, and(or(...tested.flatMap(({ terms }) => [
+            titleAny(terms),
+            summaryAny(terms),
+        ])), ...tested.map(({ terms, tsquery }) => or(titleAny(terms), summaryAny(terms), sql `${docVector} @@ ${tsquery}::tsquery`))));
+    };
+    const plainWordMatch = everyPlainWordMatch();
     const match = groups.length || query.negatives.length
-        ? and(...groups.map((group) => anyField(group.terms)), ...query.negatives.map((negative) => not(anyField([negative]))))
+        ? and(...(plainWordMatch
+            ? [plainWordMatch]
+            : groups.map((group) => anyField(group.terms))), ...query.negatives.map((negative) => not(anyField([negative]))))
         : sql `false`;
     const simpleQueries = groups.length > 0 && groups.every((group) => group.terms.length === 1)
         ? [groups.map((group) => group.terms[0].text.trim()).join(" ")]
@@ -132,11 +167,13 @@ export function indexedSearchSql(options) {
         ? termTsquery(phraseTerms, { prefix: true, weights: "C" })
         : null;
     const bodyPhrase = phraseQuery
-        ? sql `case when ${sql.raw(`${ALIAS}.doc_vector`)} @@ ${phraseQuery}::tsquery then 1 else 0 end`
+        ? sql `case when ${docVector} @@ ${phraseQuery}::tsquery then 1 else 0 end`
         : null;
     return {
-        join: sql `${sql.raw(SEARCH_RESOURCES_TABLE)} AS ${sql.raw(ALIAS)}`,
-        on: sql `${sql.raw(`${ALIAS}.app`)} = ${registration.app} AND ${sql.raw(`${ALIAS}.resource_type`)} = ${registration.type} AND ${sql.raw(`${ALIAS}.resource_id`)} = ${registration.idColumn}::text`,
+        // LATERAL looks up each row the app's query keeps, and OFFSET keeps Postgres
+        // from folding the lookup back into a join it would start from this table.
+        join: sql `LATERAL (SELECT * FROM ${sql.raw(SEARCH_RESOURCES_TABLE)} WHERE app = ${registration.app} AND resource_type = ${registration.type} AND resource_id = ${registration.idColumn}::text OFFSET 0) AS ${sql.raw(ALIAS)}`,
+        on: sql `true`,
         match,
         matchTier,
         titleCoverage: titleCoverage ?? zero,

package/dist/search/tokenize.d.ts

@@ -100,4 +100,5 @@ export interface QueryPhraseOptions {
 export declare function termTsquery(text: string, options?: QueryPhraseOptions): string | null;
 /** Whether a term is more than one lexeme, so it matches as a phrase. */
 export declare function isPhraseTerm(text: string): boolean;
+export declare function allOfTsquery(parts: readonly string[]): string;
 export declare function anyOfTsquery(parts: readonly (string | null)[]): string | null;

package/dist/search/tokenize.js

@@ -357,6 +357,9 @@ export function termTsquery(text, options = {}) {
 export function isPhraseTerm(text) {
     return queryLexemes(text).length > 1;
 }
+export function allOfTsquery(parts) {
+    return parts.map((part) => `(${part})`).join(" & ");
+}
 export function anyOfTsquery(parts) {
     const present = parts.filter((part) => !!part);
     if (!present.length)

package/dist/secrets/api-keys.d.ts

@@ -19,6 +19,8 @@ export interface ApiKeyEntry {
      * shared row (owner `org`) or, for owner `user`, the caller's solo row.
      */
     storedScope: SecretScope;
+    /** Exact outbound origins approved for this saved row. Empty or absent denies forwarding. */
+    urlAllowlist?: string[] | null;
     /** "••••1234". Absent on managed keys, which only say they exist. */
     masked?: string;
     updatedAt: number | null;
@@ -34,6 +36,8 @@ export interface ApiKeyEntry {
     managedBy?: SecretManagedBy;
     /** Saving a new value writes this same row. */
     canReplace: boolean;
+    /** The caller may edit this custom row's outbound origin policy. */
+    canEditOrigins?: boolean;
     canDelete: boolean;
     /** A registered validator can check the stored value. */
     canTest: boolean;

package/dist/secrets/api-keys.js

@@ -73,11 +73,15 @@ function toEntry(caller, meta, owner, manages) {
         target.scopeId === meta.scopeId &&
         registered?.kind !== "oauth";
     const canReplace = mayChange && !provider && writesThisRow;
+    const canEditOrigins = mayChange && !registered && !provider;
     return {
         name: meta.key,
         ...(registered ? { label: registered.label } : {}),
         scope: owner,
         storedScope: meta.scope,
+        ...(canReplace || canEditOrigins
+            ? { urlAllowlist: meta.urlAllowlist }
+            : {}),
         ...(managedBy || !meta.last4 ? {} : { masked: meta.last4 }),
         updatedAt: meta.updatedAt || null,
         ...(vault ? { vault: true } : {}),
@@ -87,6 +91,7 @@ function toEntry(caller, meta, owner, manages) {
         usedFor: describeSecretUsage(meta.key),
         ...(managedBy ? { managedBy } : {}),
         canReplace,
+        canEditOrigins,
         canDelete: mayChange,
         canTest: canReplace && !!registered?.validator,
     };

package/dist/secrets/register.d.ts

@@ -46,6 +46,8 @@ export interface RegisteredSecret {
     kind: SecretKind;
     required?: boolean;
     validator?: SecretValidator;
+    /** Approved origins for outbound `${keys.NAME}` requests. */
+    urlAllowlist?: readonly string[];
     oauthProvider?: string;
     oauthConnectUrl?: string;
     /** What this app uses the key for. Framework uses merge in at read time. */

package/dist/secrets/routes.d.ts

@@ -55,14 +55,14 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     errorCode: "secret_managed_elsewhere";
     managedBy: SecretManagedBy;
 } | {
-    ok?: undefined;
     error: string;
     errorCode?: undefined;
+    ok?: undefined;
     status?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     errorCode: string;
+    ok?: undefined;
     status?: undefined;
 } | {
     error?: undefined;

package/dist/secrets/routes.js

@@ -7,14 +7,15 @@
  */
 import { defineEventHandler, getMethod, getQuery, setResponseStatus, } from "h3";
 import { readBody } from "../server/h3-helpers.js";
+import { isLoopbackHost } from "../server/origin-allowlist.js";
 import { runWithRequestContext } from "../server/request-context.js";
 async function canMutateWorkspaceScope(event, scopeId) {
     if (scopeId.startsWith("solo:"))
         return true;
     const { getOrgContext } = await import("../org/context.js");
     const ctx = await getOrgContext(event).catch(() => null);
-    if (!ctx?.orgId)
-        return true;
+    if (!ctx?.orgId || ctx.orgId !== scopeId)
+        return false;
     return ctx.role === "owner" || ctx.role === "admin";
 }
 /**
@@ -35,7 +36,8 @@ import { PERSONAL_PROVIDER_KEYS_RESTRICTED_ERROR_CODE, resolvePersonalProviderKe
 import { canonicalSecretKey, secretKeyNames } from "./key-aliases.js";
 import { isManagedDeleteAllowed, managedDeleteRefusal, resolveSecretManagedBy, } from "./managed-keys.js";
 import { listRequiredSecrets, getRequiredSecret, } from "./register.js";
-import { writeAppSecret, deleteAppSecret, last4, listAppSecretsForScope, readAppSecretMeta, VAULT_SYNC_DESCRIPTION_PREFIX, } from "./storage.js";
+import { writeAppSecret, updateAppSecretUrlAllowlist, deleteAppSecret, last4, listAppSecretsForScope, readAppSecretMeta, VAULT_SYNC_DESCRIPTION_PREFIX, } from "./storage.js";
+import { registeredUrlAllowlist, validateUrlAllowlist, } from "./substitution.js";
 import { describeSecretUsage } from "./usage.js";
 export const SECRET_REJECTED_ERROR_CODE = "secret_rejected";
 export const SECRET_VALIDATION_UNAVAILABLE_ERROR_CODE = "secret_validation_unavailable";
@@ -267,6 +269,15 @@ async function handleWrite(event, secret) {
         setResponseStatus(event, 400);
         return { error: "value is required" };
     }
+    let urlAllowlist;
+    if (body.urlAllowlist !== undefined) {
+        const normalized = normalizeUrlAllowlist(body.urlAllowlist, registeredUrlAllowlist(secret.key));
+        if (normalized.ok === false) {
+            setResponseStatus(event, 400);
+            return { error: normalized.error };
+        }
+        urlAllowlist = JSON.stringify(normalized.origins);
+    }
     const { scopeId, reason } = await resolveScopeId(event, secret.scope);
     if (!scopeId) {
         setResponseStatus(event, 401);
@@ -339,6 +350,7 @@ async function handleWrite(event, secret) {
             value,
             scope: secret.scope,
             scopeId,
+            ...(urlAllowlist === undefined ? {} : { urlAllowlist }),
         });
     }
     catch (err) {
@@ -510,6 +522,9 @@ export function createAdHocSecretHandler() {
         if (method === "POST" && !name) {
             return handleAdHocWrite(event);
         }
+        if (method === "PATCH" && name) {
+            return handleAdHocPolicyUpdate(event, name);
+        }
         if (method === "DELETE" && name) {
             return handleAdHocDelete(event, name);
         }
@@ -615,6 +630,56 @@ async function handleAdHocWrite(event) {
     }
     return { ok: true, key: name };
 }
+async function handleAdHocPolicyUpdate(event, name) {
+    if (getRequiredSecret(name) || resolveSecretManagedBy(name)) {
+        setResponseStatus(event, 403);
+        return { error: "This key is managed by another settings surface" };
+    }
+    const rawBody = await readBody(event);
+    if (!rawBody || typeof rawBody !== "object" || Array.isArray(rawBody)) {
+        setResponseStatus(event, 400);
+        return { error: "A policy update body is required" };
+    }
+    const body = rawBody;
+    if (body.scope !== "user" &&
+        body.scope !== "org" &&
+        body.scope !== "workspace") {
+        setResponseStatus(event, 400);
+        return { error: "A saved key scope is required" };
+    }
+    if ((body.owner !== "user" && body.owner !== "org") ||
+        (body.owner === "user" && body.scope === "org") ||
+        (body.owner === "org" && body.scope === "user")) {
+        setResponseStatus(event, 400);
+        return { error: "A saved key owner is required" };
+    }
+    const normalized = normalizeUrlAllowlist(body.urlAllowlist);
+    if (normalized.ok === false) {
+        setResponseStatus(event, 400);
+        return { error: normalized.error };
+    }
+    const scope = body.scope;
+    const resolved = await resolveScopeId(event, scope === "workspace" && body.owner === "user" ? "user" : scope);
+    const scopeId = resolved.scopeId && scope === "workspace" && body.owner === "user"
+        ? `solo:${resolved.scopeId}`
+        : resolved.scopeId;
+    if (!scopeId) {
+        setResponseStatus(event, 401);
+        return { error: resolved.reason ?? "Unable to resolve scope" };
+    }
+    if (body.owner === "org" && !(await canMutateOrgScope(event, scopeId))) {
+        setResponseStatus(event, 403);
+        return {
+            error: "Only organization owners and admins can edit shared keys",
+        };
+    }
+    const updated = await updateAppSecretUrlAllowlist({ key: name, scope, scopeId }, normalized.origins);
+    if (!updated) {
+        setResponseStatus(event, 404);
+        return { error: "Saved key not found" };
+    }
+    return { ok: true, key: name, urlAllowlist: normalized.origins };
+}
 async function handleAdHocDelete(event, name) {
     if (getRequiredSecret(name)) {
         setResponseStatus(event, 400);
@@ -693,7 +758,7 @@ function extractAdHocName(event) {
         return null;
     return AD_HOC_NAME_REGEX.test(candidate) ? candidate : null;
 }
-function normalizeUrlAllowlist(input) {
+function normalizeUrlAllowlist(input, maximum = null) {
     if (!Array.isArray(input) || !input.every((v) => typeof v === "string")) {
         return { ok: false, error: "urlAllowlist must be an array of strings" };
     }
@@ -712,15 +777,29 @@ function normalizeUrlAllowlist(input) {
                 error: `urlAllowlist entry "${value}" is not a valid URL`,
             };
         }
-        if (url.protocol !== "https:" && url.protocol !== "http:") {
+        if (url.protocol !== "https:" &&
+            !(url.protocol === "http:" && isLoopbackHost(url.host))) {
+            return {
+                ok: false,
+                error: `urlAllowlist entry "${value}" must use https (or local loopback http)`,
+            };
+        }
+        if (url.username || url.password) {
             return {
                 ok: false,
-                error: `urlAllowlist entry "${value}" must use http or https`,
+                error: "urlAllowlist entries cannot contain credentials",
             };
         }
         if (!origins.includes(url.origin))
             origins.push(url.origin);
     }
+    if (maximum &&
+        origins.some((origin) => !validateUrlAllowlist(origin, maximum))) {
+        return {
+            ok: false,
+            error: "urlAllowlist exceeds the registered provider policy",
+        };
+    }
     return { ok: true, origins };
 }
 function extractKeyFromEvent(event, opts = {}) {

package/dist/secrets/storage.d.ts

@@ -41,6 +41,8 @@ export declare class AppSecretKeyMismatchError extends Error {
  * record's id.
  */
 export declare function writeAppSecret(args: WriteSecretArgs): Promise<string>;
+/** Change an existing key's outbound policy without reading or replacing its value. */
+export declare function updateAppSecretUrlAllowlist(ref: SecretRef, origins: readonly string[]): Promise<boolean>;
 export interface ReadSecretResult {
     value: string;
     last4: string;

package/dist/secrets/storage.js

@@ -144,7 +144,7 @@ export async function writeAppSecret(args) {
       encrypted_value = excluded.encrypted_value,
       shared_encrypted_value = excluded.shared_encrypted_value,
       description = excluded.description,
-      url_allowlist = excluded.url_allowlist,
+      url_allowlist = COALESCE(excluded.url_allowlist, app_secrets.url_allowlist),
       updated_at = excluded.updated_at`;
     const upsertArgs = [
         id,
@@ -167,6 +167,29 @@ export async function writeAppSecret(args) {
     invalidateAgentEngineStatusCache();
     return String(rows[0]?.id ?? id);
 }
+/** Change an existing key's outbound policy without reading or replacing its value. */
+export async function updateAppSecretUrlAllowlist(ref, origins) {
+    await ensureTable();
+    const { rows } = await getDbExec().execute({
+        sql: `UPDATE app_secrets SET url_allowlist = ?, updated_at = ?
+      WHERE scope = ? AND scope_id = ? AND key = ?
+        AND (description IS NULL OR description NOT LIKE ?)
+      RETURNING id`,
+        args: [
+            JSON.stringify(origins),
+            Date.now(),
+            ref.scope,
+            ref.scopeId,
+            ref.key,
+            `${VAULT_SYNC_DESCRIPTION_PREFIX}%`,
+        ],
+    });
+    if (rows.length === 0)
+        return false;
+    invalidateRequestSecret(ref);
+    invalidateOptionalKeyCache();
+    return true;
+}
 function decryptAppSecretValue(encrypted, sharedEncrypted) {
     if (sharedEncrypted) {
         try {
@@ -540,18 +563,20 @@ export async function listAppSecretsForScope(scope, scopeId) {
     return results;
 }
 function parseAllowlist(raw) {
-    if (!raw)
+    if (raw === null)
         return null;
+    let parsed;
     try {
-        const parsed = JSON.parse(raw);
-        if (Array.isArray(parsed) && parsed.every((v) => typeof v === "string")) {
-            return parsed;
-        }
-        return null;
+        parsed = JSON.parse(raw);
     }
-    catch {
-        return null;
+    catch (error) {
+        throw new Error("Stored secret URL policy is unreadable", { cause: error });
+    }
+    if (!Array.isArray(parsed) ||
+        !parsed.every((value) => typeof value === "string")) {
+        throw new Error("Stored secret URL policy is invalid");
     }
+    return parsed;
 }
 export async function deleteAppSecret(ref) {
     await ensureTable();

package/dist/secrets/substitution.d.ts

@@ -24,7 +24,7 @@
  * installs benefit from the stricter default — opt in only after the
  * org-admin write-gate is verified to be active.
  */
-import type { SecretScope } from "./register.js";
+import { type SecretScope } from "./register.js";
 export interface ResolveKeyReferencesResult {
     resolved: string;
     usedKeys: string[];
@@ -38,7 +38,8 @@ export interface ResolvedKeyReference {
 }
 export declare function resolveKeyReferences(text: string, scope: SecretScope, scopeId: string): Promise<ResolveKeyReferencesResult>;
 export declare function resolveKeyReferencesWithRequestScopes(text: string, userScopeId: string): Promise<ResolveKeyReferencesResult>;
-export declare function validateUrlAllowlist(url: string, allowlist: string[] | null): boolean;
+export declare function registeredUrlAllowlist(name: string): string[] | null;
+export declare function validateUrlAllowlist(url: string, allowlist: readonly string[] | null): boolean;
 /**
  * Convenience helper: look up a key's allowlist by name+scope. Returns null
  * when the key doesn't exist or has no allowlist configured.