@agent-native/core 0.227.0 → 0.228.0-nightly-20261111004142

package/dist/coding-tools/run-code.js

@@ -341,7 +341,8 @@ async function describeSandboxExecutionForOwner(executionId, context) {
             guidance: "Background executions are scoped to the user who started them. Retry from an authenticated agent run.",
         });
     }
-    let row = await getSandboxExecutionForOwner(executionId, owner);
+    const orgId = context?.orgId ?? getRequestContext()?.orgId ?? null;
+    let row = await getSandboxExecutionForOwner(executionId, owner, orgId);
     if (!row) {
         return structuredRunCodeError({
             executionId,
@@ -397,7 +398,16 @@ async function describeSandboxExecutionForOwner(executionId, context) {
             }, null, 2);
         }
         await failExpiredSandboxExecution(row.id, `Executor lease expired after ${row.attemptCount} attempt(s); the execution environment was likely terminated before the code finished. Split the computation into smaller chunks or persist intermediate results (e.g. workspaceWrite) and run again.`, now);
-        row = (await getSandboxExecutionForOwner(executionId, owner)) ?? row;
+        const refreshed = await getSandboxExecutionForOwner(executionId, owner, orgId);
+        if (!refreshed) {
+            return structuredRunCodeError({
+                executionId,
+                code: "execution_not_found",
+                message: `No background execution "${executionId}" exists for this user.`,
+                guidance: "Check the executionId and your current organization access.",
+            });
+        }
+        row = refreshed;
     }
     return formatTerminalSandboxExecution(row);
 }

package/dist/coding-tools/sandbox/executions-store.d.ts

@@ -53,7 +53,7 @@ export declare const sandboxExecutionsStore: import("../../db/store-registry.js"
 export declare function ensureTable(): Promise<void>;
 export declare function resetSandboxExecutionsStoreForTests(): void;
 export declare function createSandboxExecution(input: CreateSandboxExecutionInput): Promise<SandboxExecutionRow>;
-export declare function getSandboxExecutionForOwner(id: string, owner: string): Promise<SandboxExecutionRow | null>;
+export declare function getSandboxExecutionForOwner(id: string, owner: string, orgId: string | null): Promise<SandboxExecutionRow | null>;
 export declare function getSandboxExecutionInternal(id: string): Promise<SandboxExecutionRow | null>;
 export declare function claimSandboxExecution(id: string, claimToken: string, leaseMs: number, now?: number): Promise<SandboxExecutionRow | null>;
 export declare function renewSandboxExecutionLease(id: string, claimToken: string, leaseMs: number, now?: number): Promise<boolean>;

package/dist/coding-tools/sandbox/executions-store.js

@@ -38,6 +38,7 @@ import crypto from "node:crypto";
 import { getDbExec } from "../../db/client.js";
 import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../../db/ddl-guard.js";
 import { defineStore } from "../../db/store-registry.js";
+import { isOrgMember } from "../../org/membership.js";
 export const SANDBOX_EXECUTION_DEFAULT_MAX_ATTEMPTS = 2;
 export const SANDBOX_EXECUTION_MAX_STORED_OUTPUT_CHARS = 200_000;
 const TABLE = "sandbox_executions";
@@ -218,16 +219,21 @@ export async function createSandboxExecution(input) {
         throw new Error(`sandbox execution ${id} vanished after insert`);
     return row;
 }
-export async function getSandboxExecutionForOwner(id, owner) {
+export async function getSandboxExecutionForOwner(id, owner, orgId) {
     if (!id || !owner)
         return null;
     await ensureTable();
     const client = getDbExec();
     const result = await client.execute({
-        sql: `SELECT * FROM ${TABLE} WHERE id = ? AND owner = ? LIMIT 1`,
-        args: [id, owner],
+        sql: "SELECT * FROM sandbox_executions WHERE id = ? AND owner = ? AND org_id IS NOT DISTINCT FROM ? LIMIT 1",
+        args: [id, owner, orgId],
     });
     const raw = result.rows?.[0];
+    if (raw &&
+        orgId &&
+        !(await isOrgMember(orgId, owner, { requireOrganizationMetadata: true }))) {
+        return null;
+    }
     return raw ? rowFromDb(raw) : null;
 }
 export async function getSandboxExecutionInternal(id) {

package/dist/collab/routes.d.ts

@@ -26,9 +26,9 @@ export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import
     ok: boolean;
 }>>;
 export declare const postCollabText: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    text?: undefined;
     ok?: undefined;
     error: string;
+    text?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/data-programs/execute.js

@@ -329,7 +329,7 @@ async function runBackgroundProgram(program, args, paramsHash, timeoutMs) {
     const backgroundTimeout = Math.max(timeoutMs, BACKGROUND_TIMEOUT_MS);
     const active = await getActiveRun(program.id, paramsHash);
     if (active?.executionId && args.ctx.userEmail) {
-        const execution = await getSandboxExecutionForOwner(active.executionId, args.ctx.userEmail);
+        const execution = await getSandboxExecutionForOwner(active.executionId, args.ctx.userEmail, args.ctx.orgId ?? null);
         if (execution &&
             execution.status !== "queued" &&
             execution.status !== "running") {

package/dist/db/schema-snapshot.generated.js

@@ -38,8 +38,9 @@ export const SCHEMA_SNAPSHOT = {
         'CREATE TABLE "agent_native_embed_session_revocations" (\n  "owner_hash" text NOT NULL,\n  "revoked_before" bigint NOT NULL\n);',
         'CREATE TABLE "agent_native_embed_tickets" (\n  "ticket_hash" text NOT NULL,\n  "owner_email" text NOT NULL,\n  "org_id" text,\n  "target_path" text NOT NULL,\n  "scope" text,\n  "created_at" bigint NOT NULL,\n  "expires_at" bigint NOT NULL,\n  "consumed_at" bigint,\n  "renewal_expires_at" bigint,\n  "session_active_until" bigint,\n  "audience_host" text,\n  "audience_base_path" text\n);',
         'CREATE TABLE "agent_resource_versions" (\n  "id" text NOT NULL,\n  "resource_type" text NOT NULL,\n  "resource_id" text NOT NULL,\n  "version_number" bigint NOT NULL,\n  "created_at" text NOT NULL,\n  "created_by" text,\n  "actor_kind" text DEFAULT \'human\'::text NOT NULL,\n  "owner_email" text,\n  "org_id" text,\n  "visibility" text DEFAULT \'private\'::text NOT NULL,\n  "title" text,\n  "summary" text,\n  "snapshot_json" text NOT NULL,\n  "metadata_json" text\n);',
+        'CREATE TABLE "agent_review_comment_links" (\n  "provider" text NOT NULL,\n  "external_kind" text NOT NULL,\n  "external_id" text NOT NULL,\n  "comment_id" text NOT NULL,\n  "resource_type" text NOT NULL,\n  "resource_id" text NOT NULL,\n  "created_at" text NOT NULL\n);',
         'CREATE TABLE "agent_review_comment_reactions" (\n  "comment_id" text NOT NULL,\n  "actor_email" text NOT NULL,\n  "reaction" text NOT NULL,\n  "created_at" text NOT NULL\n);',
-        'CREATE TABLE "agent_review_comments" (\n  "id" text NOT NULL,\n  "resource_type" text NOT NULL,\n  "resource_id" text NOT NULL,\n  "thread_id" text NOT NULL,\n  "parent_comment_id" text,\n  "target_id" text,\n  "kind" text DEFAULT \'comment\'::text NOT NULL,\n  "status" text DEFAULT \'open\'::text NOT NULL,\n  "anchor_json" text,\n  "body" text NOT NULL,\n  "author_email" text,\n  "author_name" text,\n  "created_by" text DEFAULT \'human\'::text NOT NULL,\n  "resolution_target" text,\n  "reply_route_target" text DEFAULT \'legacy\'::text,\n  "notification_completed_at" text,\n  "mentions_json" text,\n  "owner_email" text,\n  "org_id" text,\n  "visibility" text DEFAULT \'private\'::text NOT NULL,\n  "resolved_by" text,\n  "resolved_at" text,\n  "consumed_at" text,\n  "deleted_by" text,\n  "deleted_at" text,\n  "created_at" text NOT NULL,\n  "updated_at" text NOT NULL,\n  "metadata_json" text\n);',
+        'CREATE TABLE "agent_review_comments" (\n  "id" text NOT NULL,\n  "resource_type" text NOT NULL,\n  "resource_id" text NOT NULL,\n  "thread_id" text NOT NULL,\n  "parent_comment_id" text,\n  "target_id" text,\n  "kind" text DEFAULT \'comment\'::text NOT NULL,\n  "status" text DEFAULT \'open\'::text NOT NULL,\n  "anchor_json" text,\n  "body" text NOT NULL,\n  "author_email" text,\n  "author_name" text,\n  "created_by" text DEFAULT \'human\'::text NOT NULL,\n  "resolution_target" text,\n  "reply_route_target" text DEFAULT \'legacy\'::text,\n  "notification_completed_at" text,\n  "mentions_json" text,\n  "owner_email" text,\n  "org_id" text,\n  "visibility" text DEFAULT \'private\'::text NOT NULL,\n  "resolved_by" text,\n  "resolved_at" text,\n  "consumed_at" text,\n  "deleted_by" text,\n  "deleted_at" text,\n  "created_at" text NOT NULL,\n  "updated_at" text NOT NULL,\n  "metadata_json" text,\n  "surface_id" text,\n  "anchor_kind" text,\n  "anchor_version" integer,\n  "revision" integer DEFAULT 1 NOT NULL\n);',
         'CREATE TABLE "agent_review_notification_deliveries" (\n  "comment_id" text NOT NULL,\n  "recipient_email" text NOT NULL,\n  "claim_token" text NOT NULL,\n  "claimed_at" text NOT NULL,\n  "sent_at" text\n);',
         'CREATE TABLE "agent_review_statuses" (\n  "id" text NOT NULL,\n  "resource_type" text NOT NULL,\n  "resource_id" text NOT NULL,\n  "status" text NOT NULL,\n  "note" text,\n  "updated_by" text,\n  "updated_at" text NOT NULL,\n  "owner_email" text,\n  "org_id" text,\n  "visibility" text DEFAULT \'private\'::text NOT NULL,\n  "metadata_json" text\n);',
         'CREATE TABLE "agent_review_suggestion_amendments" (\n  "idempotency_key" text NOT NULL,\n  "suggestion_id" text NOT NULL,\n  "revision" integer NOT NULL,\n  "author_email" text NOT NULL,\n  "owner_email" text,\n  "org_id" text,\n  "visibility" text DEFAULT \'private\'::text NOT NULL,\n  "request_json" text NOT NULL,\n  "before_json" text NOT NULL,\n  "after_json" text NOT NULL,\n  "created_at" text NOT NULL\n);',
@@ -49,7 +50,7 @@ export const SCHEMA_SNAPSHOT = {
         'CREATE TABLE "agent_review_suggestion_proposal_creations" (\n  "idempotency_key" text NOT NULL,\n  "proposal_id" text NOT NULL,\n  "author_email" text,\n  "actor_kind" text NOT NULL,\n  "request_hash" text NOT NULL,\n  "suggestion_ids_json" text NOT NULL\n);',
         'CREATE TABLE "agent_review_suggestion_proposal_decisions" (\n  "idempotency_key" text NOT NULL,\n  "proposal_id" text NOT NULL,\n  "reviewer" text,\n  "decision" text NOT NULL,\n  "request_json" text NOT NULL,\n  "suggestion_ids_json" text NOT NULL,\n  "created_at" text NOT NULL\n);',
         'CREATE TABLE "agent_review_suggestion_proposals" (\n  "id" text NOT NULL,\n  "resource_type" text NOT NULL,\n  "resource_id" text NOT NULL,\n  "adapter_kind" text NOT NULL,\n  "summary" text NOT NULL,\n  "author_email" text,\n  "actor_kind" text NOT NULL,\n  "created_at" text NOT NULL\n);',
-        'CREATE TABLE "agent_review_suggestions" (\n  "id" text NOT NULL,\n  "resource_type" text NOT NULL,\n  "resource_id" text NOT NULL,\n  "adapter_kind" text NOT NULL,\n  "adapter_version" integer NOT NULL,\n  "thread_id" text NOT NULL,\n  "author_email" text,\n  "actor_kind" text NOT NULL,\n  "base_revision" text NOT NULL,\n  "status" text DEFAULT \'pending\'::text NOT NULL,\n  "summary" text NOT NULL,\n  "owner_email" text,\n  "org_id" text,\n  "visibility" text DEFAULT \'private\'::text NOT NULL,\n  "created_at" text NOT NULL,\n  "updated_at" text NOT NULL,\n  "metadata_json" text,\n  "revision" integer DEFAULT 1 NOT NULL,\n  "proposal_id" text\n);',
+        'CREATE TABLE "agent_review_suggestions" (\n  "id" text NOT NULL,\n  "resource_type" text NOT NULL,\n  "resource_id" text NOT NULL,\n  "adapter_kind" text NOT NULL,\n  "adapter_version" integer NOT NULL,\n  "thread_id" text NOT NULL,\n  "author_email" text,\n  "actor_kind" text NOT NULL,\n  "base_revision" text NOT NULL,\n  "status" text DEFAULT \'pending\'::text NOT NULL,\n  "summary" text NOT NULL,\n  "owner_email" text,\n  "org_id" text,\n  "visibility" text DEFAULT \'private\'::text NOT NULL,\n  "created_at" text NOT NULL,\n  "updated_at" text NOT NULL,\n  "metadata_json" text,\n  "revision" integer DEFAULT 1 NOT NULL,\n  "proposal_id" text,\n  "author_source" text,\n  "author_client" text\n);',
         'CREATE TABLE "agent_review_thread_preferences" (\n  "thread_id" text NOT NULL,\n  "user_email" text NOT NULL,\n  "muted" integer DEFAULT 0 NOT NULL,\n  "unread" integer DEFAULT 0 NOT NULL,\n  "updated_at" text NOT NULL\n);',
         'CREATE TABLE "agent_run_events" (\n  "run_id" text NOT NULL,\n  "seq" bigint NOT NULL,\n  "event_at" bigint,\n  "event_data" text NOT NULL,\n  "transcript_order" bigint\n);',
         'CREATE TABLE "agent_run_outcome_daily" (\n  "day" text NOT NULL,\n  "status" text NOT NULL,\n  "terminal_reason" text DEFAULT \'\'::text NOT NULL,\n  "run_count" bigint DEFAULT 0 NOT NULL\n);',
@@ -112,7 +113,7 @@ export const SCHEMA_SNAPSHOT = {
         'CREATE TABLE "invitation" (\n  "id" text NOT NULL,\n  "organization_id" text NOT NULL,\n  "email" text NOT NULL,\n  "role" text,\n  "status" text DEFAULT \'pending\'::text NOT NULL,\n  "expires_at" timestamp with time zone NOT NULL,\n  "inviter_id" text NOT NULL,\n  "created_at" timestamp with time zone NOT NULL,\n  "updated_at" timestamp with time zone NOT NULL\n);',
         'CREATE TABLE "jwks" (\n  "id" text NOT NULL,\n  "public_key" text NOT NULL,\n  "private_key" text NOT NULL,\n  "created_at" timestamp with time zone NOT NULL,\n  "expires_at" timestamp with time zone,\n  "alg" text,\n  "crv" text\n);',
         'CREATE TABLE "mcp_action_approvals" (\n  "nonce" text NOT NULL,\n  "caller_key" text NOT NULL,\n  "action_name" text NOT NULL,\n  "arguments_hash" text NOT NULL,\n  "expires_at" bigint NOT NULL,\n  "consumed_at" bigint,\n  "owner_email" text,\n  "org_id" text,\n  "app_id" text,\n  "call_arguments" text,\n  "status" text DEFAULT \'pending\'::text NOT NULL,\n  "prompt_answered_at" bigint,\n  "approver_email" text,\n  "approved_at" bigint,\n  "denied_at" bigint,\n  "created_at" bigint,\n  "run_status" text,\n  "run_settled_at" bigint,\n  "oauth_client_id" text,\n  "retry_safe" boolean DEFAULT false NOT NULL\n);',
-        'CREATE TABLE "mcp_connect_tokens" (\n  "id" text NOT NULL,\n  "jti" text NOT NULL,\n  "owner_email" text NOT NULL,\n  "org_id" text,\n  "label" text,\n  "kind" text DEFAULT \'personal\'::text NOT NULL,\n  "service_name" text,\n  "created_by" text,\n  "created_at" bigint,\n  "last_used_at" bigint,\n  "revoked_at" bigint\n);',
+        'CREATE TABLE "mcp_connect_tokens" (\n  "id" text NOT NULL,\n  "jti" text NOT NULL,\n  "owner_email" text NOT NULL,\n  "org_id" text,\n  "label" text,\n  "kind" text DEFAULT \'personal\'::text NOT NULL,\n  "service_name" text,\n  "created_by" text,\n  "created_at" bigint,\n  "last_used_at" bigint,\n  "revoked_at" bigint,\n  "client_name" text,\n  "resource" text,\n  "expires_at" bigint\n);',
         'CREATE TABLE "mcp_device_codes" (\n  "device_code" text NOT NULL,\n  "user_code" text NOT NULL,\n  "owner_email" text,\n  "org_id" text,\n  "status" text DEFAULT \'pending\'::text NOT NULL,\n  "token_jti" text,\n  "catalog_scope" text,\n  "created_at" bigint,\n  "expires_at" bigint,\n  "consumed_at" bigint,\n  "client" text,\n  "purpose" text\n);',
         'CREATE TABLE "mcp_oauth_clients" (\n  "client_id" text NOT NULL,\n  "client_name" text,\n  "redirect_uris" text NOT NULL,\n  "grant_types" text,\n  "response_types" text,\n  "token_endpoint_auth_method" text,\n  "application_type" text,\n  "created_at" bigint\n);',
         'CREATE TABLE "mcp_oauth_codes" (\n  "code" text NOT NULL,\n  "client_id" text NOT NULL,\n  "redirect_uri" text NOT NULL,\n  "code_challenge" text NOT NULL,\n  "code_challenge_method" text NOT NULL,\n  "owner_email" text NOT NULL,\n  "issued_for_email" text,\n  "org_id" text,\n  "org_domain" text,\n  "scope" text NOT NULL,\n  "resource" text NOT NULL,\n  "created_at" bigint,\n  "expires_at" bigint,\n  "consumed_at" bigint,\n  "client_name" text\n);',
@@ -212,6 +213,7 @@ export const SCHEMA_SNAPSHOT = {
         'ALTER TABLE "agent_native_embed_session_revocations" ADD CONSTRAINT "agent_native_embed_session_revocations_pkey" PRIMARY KEY (owner_hash);',
         'ALTER TABLE "agent_native_embed_tickets" ADD CONSTRAINT "agent_native_embed_tickets_pkey" PRIMARY KEY (ticket_hash);',
         'ALTER TABLE "agent_resource_versions" ADD CONSTRAINT "agent_resource_versions_pkey" PRIMARY KEY (id);',
+        'ALTER TABLE "agent_review_comment_links" ADD CONSTRAINT "agent_review_comment_links_pkey" PRIMARY KEY (provider, external_kind, external_id);',
         'ALTER TABLE "agent_review_comment_reactions" ADD CONSTRAINT "agent_review_comment_reactions_pkey" PRIMARY KEY (comment_id, actor_email, reaction);',
         'ALTER TABLE "agent_review_comments" ADD CONSTRAINT "agent_review_comments_pkey" PRIMARY KEY (id);',
         'ALTER TABLE "agent_review_notification_deliveries" ADD CONSTRAINT "agent_review_notification_deliveries_pkey" PRIMARY KEY (comment_id, recipient_email);',
@@ -432,6 +434,7 @@ export const SCHEMA_SNAPSHOT = {
         "CREATE INDEX idx_agent_resource_versions_org ON public.agent_resource_versions USING btree (org_id, created_at);",
         "CREATE INDEX idx_agent_resource_versions_owner ON public.agent_resource_versions USING btree (owner_email, created_at);",
         "CREATE UNIQUE INDEX idx_agent_resource_versions_resource_number ON public.agent_resource_versions USING btree (resource_type, resource_id, version_number);",
+        "CREATE INDEX idx_agent_review_comment_links_comment ON public.agent_review_comment_links USING btree (comment_id);",
         "CREATE INDEX agent_review_comments_access_owner_lower_idx ON public.agent_review_comments USING btree (lower(owner_email));",
         "CREATE INDEX idx_agent_review_comments_org ON public.agent_review_comments USING btree (org_id, created_at);",
         "CREATE INDEX idx_agent_review_comments_owner ON public.agent_review_comments USING btree (owner_email, created_at);",
@@ -551,6 +554,7 @@ export const SCHEMA_SNAPSHOT = {
         "CREATE UNIQUE INDEX idx_integration_budget_subject ON public.integration_usage_budgets USING btree (partition_key, subject_type, subject_id, period);",
         "CREATE INDEX idx_integration_reservation_budget ON public.integration_usage_reservations USING btree (budget_id, window_start, status);",
         "CREATE INDEX idx_mcp_action_approvals_call ON public.mcp_action_approvals USING btree (caller_key, action_name, arguments_hash);",
+        "CREATE INDEX mcp_oauth_refresh_activity_idx ON public.mcp_oauth_refresh_tokens USING btree (client_id, lower(owner_email), lower(issued_for_email), org_id, resource) WHERE (revoked_at IS NULL);",
         "CREATE INDEX idx_notifications_owner_unread ON public.notifications USING btree (owner, read_at);",
         "CREATE INDEX observational_memory_access_owner_lower_idx ON public.observational_memory USING btree (lower(owner_email));",
         "CREATE INDEX observational_memory_thread_owner_idx ON public.observational_memory USING btree (thread_id, owner_email);",
@@ -683,6 +687,7 @@ export const SCHEMA_SNAPSHOT = {
         "agent_native_embed_session_revocations",
         "agent_native_embed_tickets",
         "agent_resource_versions",
+        "agent_review_comment_links",
         "agent_review_comment_reactions",
         "agent_review_comments",
         "agent_review_notification_deliveries",
@@ -834,6 +839,11 @@ export const SCHEMA_SNAPSHOT = {
             "67a8c1a568d3e4b8",
         ],
         ["agent_harness_sessions", "agent-harness-follow-up-recovery", null],
+        [
+            "agent_harness_sessions",
+            "agent-harness-sessions-approval-and-expiry-columns",
+            null,
+        ],
         [
             "agent_harness_sessions",
             "agent-harness-sessions-approval-resolution",
@@ -1096,7 +1106,9 @@ export const SCHEMA_SNAPSHOT = {
         ["mcp_approvals", "baseline", null],
         ["mcp_approvals", "review-page-columns", "5219a7b9642c4847"],
         ["mcp_connect", "baseline", null],
+        ["mcp_connect", "client-connection-metadata", "e3be9d6fc56a1427"],
         ["mcp_oauth", "baseline", null],
+        ["mcp_oauth", "client-activity-lookup-index", "4b5d5edf48a0f71b"],
         ["notifications", "baseline", null],
         ["oauth_tokens", "baseline", null],
         ["oauth_tokens", "oauth-tokens-display-name-column", "ea7cbba8dff602f8"],
@@ -1179,6 +1191,8 @@ export const SCHEMA_SNAPSHOT = {
         ["resources", "visibility-expires-index", null],
         ["resources", "widen-bigint", null],
         ["review", "baseline", null],
+        ["review", "storage-contract", "ed0e701a19ad1c15"],
+        ["review_suggestions", "author-source-and-client", null],
         ["review_suggestions", "baseline", null],
         ["sandbox_executions", "baseline", null],
         [

package/dist/extensions/url-safety.d.ts

@@ -12,9 +12,7 @@ export declare function createSsrfSafeDispatcher(allowedPrivateOrigins?: readonl
  *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)
  *      on the initial URL and on every redirect hop.
  *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect
- *      time (closes the DNS-rebinding TOCTOU) when the runtime supports the
- *      Node dispatcher. Edge runtimes retain preflight DNS checks, literal and
- *      rebinding-domain rejection, and per-hop redirect validation.
+ *      time (closes the DNS-rebinding TOCTOU). If unavailable, the request fails.
  *   3. Manual redirect handling — a public URL cannot 30x-redirect into the
  *      private network because each hop is re-validated before it is followed.
  *

package/dist/extensions/url-safety.js

@@ -136,12 +136,11 @@ export async function isBlockedExtensionUrlWithDns(url) {
     try {
         const { lookup } = await import("node:dns/promises");
         const records = await lookup(hostname, { all: true, verbatim: true });
-        return records.some((record) => isPrivateHost(record.address));
+        return (records.length === 0 ||
+            records.some((record) => isPrivateHost(record.address)));
     }
     catch {
-        // Some edge runtimes do not expose DNS lookup. Keep the deterministic
-        // parser-based protections instead of failing every outbound request.
-        return false;
+        return true;
     }
 }
 function normalizeLookupHostname(hostname) {
@@ -215,10 +214,7 @@ async function createSsrfSafeDispatcherUncached(allowedPrivateOrigins = [], dest
         dnsModule = await import("node:dns");
     }
     catch (error) {
-        if (options.required) {
-            throw new Error("SSRF protection is unavailable because the server dispatcher could not be loaded.", { cause: error });
-        }
-        return null;
+        throw new Error("SSRF protection is unavailable because the server dispatcher could not be loaded.", { cause: error });
     }
     const { Agent } = undici;
     const { lookup } = dnsModule;
@@ -230,10 +226,7 @@ async function createSsrfSafeDispatcherUncached(allowedPrivateOrigins = [], dest
             parsed.port || (parsed.protocol === "https:" ? "443" : "80");
     }
     if (!Agent || !lookup) {
-        if (options.required) {
-            throw new Error("SSRF protection is unavailable because the server dispatcher is incomplete.");
-        }
-        return null;
+        throw new Error("SSRF protection is unavailable because the server dispatcher is incomplete.");
     }
     return new Agent({
         connect: {
@@ -244,6 +237,11 @@ async function createSsrfSafeDispatcherUncached(allowedPrivateOrigins = [], dest
                     const list = Array.isArray(addresses)
                         ? addresses
                         : [{ address: addresses, family: 4 }];
+                    if (list.length === 0 || list.some((record) => !record.address)) {
+                        const error = new Error(`Connect blocked: ${hostname} returned no DNS address`);
+                        error.code = "EAI_BLOCKED";
+                        return callback(error);
+                    }
                     for (const record of list) {
                         const allowedOrigin = allowedPrivateOriginKeys.has(`${normalizeLookupHostname(hostname)}:${destinationPort}`);
                         const loopback = record.address === "127.0.0.1" || record.address === "::1";
@@ -273,18 +271,23 @@ export async function createSsrfSafeDispatcher(allowedPrivateOrigins = [], desti
             !allowedPrivateOrigins.includes(allowedPrivateOrigin)) {
             throw new Error("SSRF protection requires an exact localhost origin for loopback-only dispatch.");
         }
-        options = { ...options, required: true };
     }
     if (!allowedPrivateOrigin) {
         sharedSsrfDispatcher ??= createSsrfSafeDispatcherUncached();
-        const dispatcher = await sharedSsrfDispatcher;
-        if (dispatcher || !options.required)
+        try {
+            const dispatcher = await sharedSsrfDispatcher;
+            if (!dispatcher) {
+                throw new Error("SSRF protection is unavailable because the server dispatcher is empty.");
+            }
             return dispatcher;
-        return createSsrfSafeDispatcherUncached([], undefined, options);
+        }
+        catch (error) {
+            sharedSsrfDispatcher = undefined;
+            throw error;
+        }
     }
     const cacheKey = JSON.stringify([
         allowedPrivateOrigin,
-        options.required === true,
         options.loopbackOnly === true,
     ]);
     let dispatcher = privateSsrfDispatchers.get(cacheKey);
@@ -294,8 +297,8 @@ export async function createSsrfSafeDispatcher(allowedPrivateOrigins = [], desti
     }
     try {
         const resolved = await dispatcher;
-        if (!resolved && privateSsrfDispatchers.get(cacheKey) === dispatcher) {
-            privateSsrfDispatchers.delete(cacheKey);
+        if (!resolved) {
+            throw new Error("SSRF protection is unavailable because the server dispatcher is empty.");
         }
         return resolved;
     }
@@ -314,9 +317,7 @@ export async function createSsrfSafeDispatcher(allowedPrivateOrigins = [], desti
  *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)
  *      on the initial URL and on every redirect hop.
  *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect
- *      time (closes the DNS-rebinding TOCTOU) when the runtime supports the
- *      Node dispatcher. Edge runtimes retain preflight DNS checks, literal and
- *      rebinding-domain rejection, and per-hop redirect validation.
+ *      time (closes the DNS-rebinding TOCTOU). If unavailable, the request fails.
  *   3. Manual redirect handling — a public URL cannot 30x-redirect into the
  *      private network because each hop is re-validated before it is followed.
  *
@@ -379,7 +380,6 @@ export async function ssrfSafeFetch(url, init = {}, options = {}) {
         const dispatcher = await createSsrfSafeDispatcher(allowedLocalhostOrigin
             ? [allowedLocalhostOrigin]
             : options.allowedPrivateOrigins, currentUrl, {
-            required: Boolean(allowedLocalhostOrigin || options.requireDispatcher),
             loopbackOnly: Boolean(allowedLocalhostOrigin),
         });
         if (dispatcher)

package/dist/file-upload/actions/upload-image.d.ts

@@ -33,21 +33,21 @@ declare const _default: import("../../action.js").ActionDefinition<{
     idempotencyKey: string;
     deleted: boolean;
 } | {
+    provider?: undefined;
+    id?: undefined;
     error: string;
     url?: undefined;
-    id?: undefined;
-    provider?: undefined;
     configured?: undefined;
 } | {
-    error?: undefined;
     url: string;
     id: string | undefined;
     provider: string;
+    error?: undefined;
     configured?: undefined;
 } | {
-    url?: undefined;
-    id?: undefined;
     provider?: undefined;
+    id?: undefined;
+    url?: undefined;
     error: string;
     configured: boolean;
 }>;

package/dist/file-upload/index.d.ts

@@ -2,7 +2,7 @@ export type { FileUploadDeleteInput, FileUploadInput, FileUploadProvider, FileUp
 export { registerFileUploadProvider, unregisterFileUploadProvider, listFileUploadProviders, getActiveFileUploadProvider, getActiveFileUploadProviderForRequest, deleteUploadedFile, uploadFile, } from "./registry.js";
 export { builderFileUploadProvider } from "./builder.js";
 export { getBuilderUploadCredentialStatus } from "./status.js";
-export { ensureS3FileUploadProvider, s3FileUploadProvider } from "./s3.js";
+export { ensureS3FileUploadProvider, S3RequestError, s3FileUploadProvider, } from "./s3.js";
 export { cancelS3ResponseBody, fetchS3WithTimeout, presignS3GetUrl, readS3ErrorText, rfc3986, s3ObjectUri, sha256Hex, signS3Request, signedS3Request, trustedDeploymentS3Origin, type PresignS3GetOptions, type S3ClientConfig, type S3Method, type SignedS3RequestOptions, } from "./s3-client.js";
 export { FILE_STORAGE_SECRET_KEYS, getFileStorageStatus, saveFileStorage, clearFileStorage, type FileStorageField, type FileStorageProviderId, type FileStorageStatus, type SaveFileStorageInput, } from "./storage-settings.js";
 export { preUploadImageAttachments, preUploadAttachments, isFileUploadProviderConfigured, type PreUploadAttachmentsResult, type PreUploadedImageAttachment, type PreUploadedFileAttachment, } from "./pre-upload-attachments.js";

package/dist/file-upload/index.js

@@ -1,7 +1,7 @@
 export { registerFileUploadProvider, unregisterFileUploadProvider, listFileUploadProviders, getActiveFileUploadProvider, getActiveFileUploadProviderForRequest, deleteUploadedFile, uploadFile, } from "./registry.js";
 export { builderFileUploadProvider } from "./builder.js";
 export { getBuilderUploadCredentialStatus } from "./status.js";
-export { ensureS3FileUploadProvider, s3FileUploadProvider } from "./s3.js";
+export { ensureS3FileUploadProvider, S3RequestError, s3FileUploadProvider, } from "./s3.js";
 export { cancelS3ResponseBody, fetchS3WithTimeout, presignS3GetUrl, readS3ErrorText, rfc3986, s3ObjectUri, sha256Hex, signS3Request, signedS3Request, trustedDeploymentS3Origin, } from "./s3-client.js";
 export { FILE_STORAGE_SECRET_KEYS, getFileStorageStatus, saveFileStorage, clearFileStorage, } from "./storage-settings.js";
 export { preUploadImageAttachments, preUploadAttachments, isFileUploadProviderConfigured, } from "./pre-upload-attachments.js";

package/dist/file-upload/s3-client.d.ts

@@ -22,6 +22,7 @@ export interface SignedS3RequestOptions {
     /** An HTTP Range header value, such as `bytes=0-1023`. */
     range?: string | undefined;
     timeoutMs: number;
+    signal?: AbortSignal | undefined;
     /**
      * The deployment configured this endpoint and its keys (not a workspace),
      * so it may sit on a private network or use plain HTTP. Without it, only

package/dist/file-upload/s3-client.js

@@ -88,6 +88,10 @@ function unrefTimer(timer) {
  */
 export async function fetchS3WithTimeout(url, init, timeoutMs, trustedPrivateOrigin) {
     const controller = new AbortController();
+    const signal = init.signal
+        ? AbortSignal.any([controller.signal, init.signal])
+        : controller.signal;
+    signal.throwIfAborted();
     const headersTimeoutMs = timeoutMs + uploadAllowanceMs(init.body);
     let timeout;
     const createTimeoutError = (elapsedMs) => {
@@ -108,11 +112,15 @@ export async function fetchS3WithTimeout(url, init, timeoutMs, trustedPrivateOri
             reject(timeoutError);
         }, headersTimeoutMs);
     });
+    let abortHeaders;
+    const abortPromise = new Promise((_, reject) => {
+        abortHeaders = () => reject(signal.reason);
+        signal.addEventListener("abort", abortHeaders, { once: true });
+    });
     try {
         const request = (async () => {
             const isPrivateDestination = await isBlockedExtensionUrlWithDns(url);
-            if (controller.signal.aborted)
-                throw controller.signal.reason;
+            signal.throwIfAborted();
             const allowedPrivateOrigins = isPrivateDestination &&
                 trustedPrivateOrigin === new URL(url).origin &&
                 trustedPrivateOrigin
@@ -123,15 +131,29 @@ export async function fetchS3WithTimeout(url, init, timeoutMs, trustedPrivateOri
             }
             return ssrfSafeFetch(url, {
                 ...init,
-                signal: controller.signal,
+                signal,
             }, {
                 followRedirects: false,
                 requireDispatcher: true,
                 allowedPrivateOrigins,
             });
         })();
-        const response = await Promise.race([request, timeoutPromise]);
+        void request.then((response) => {
+            if (signal.aborted)
+                void response.body?.cancel().catch(() => { });
+        }, () => { });
+        const response = await Promise.race([
+            request,
+            timeoutPromise,
+            abortPromise,
+        ]);
         clearTimeoutIfRunning();
+        if (abortHeaders)
+            signal.removeEventListener("abort", abortHeaders);
+        if (signal.aborted) {
+            await response.body?.cancel().catch(() => { });
+            throw signal.reason;
+        }
         if (!response.body) {
             return response;
         }
@@ -145,14 +167,20 @@ export async function fetchS3WithTimeout(url, init, timeoutMs, trustedPrivateOri
                 idleTimeout = undefined;
             }
         };
-        const timeOutBody = () => {
+        const abortBody = () => {
             if (bodySettled)
                 return;
-            const timeoutError = createTimeoutError(timeoutMs);
             bodySettled = true;
             clearIdleTimeout();
-            controller.abort(timeoutError);
-            bodyController?.error(timeoutError);
+            signal.removeEventListener("abort", abortBody);
+            bodyController?.error(signal.reason);
+            void reader.cancel(signal.reason).catch(() => { });
+        };
+        signal.addEventListener("abort", abortBody, { once: true });
+        const timeOutBody = () => {
+            if (bodySettled)
+                return;
+            controller.abort(createTimeoutError(timeoutMs));
         };
         const resetIdleTimeout = () => {
             clearIdleTimeout();
@@ -162,18 +190,22 @@ export async function fetchS3WithTimeout(url, init, timeoutMs, trustedPrivateOri
         const body = new ReadableStream({
             start(streamController) {
                 bodyController = streamController;
-                resetIdleTimeout();
+                if (signal.aborted)
+                    abortBody();
+                else
+                    resetIdleTimeout();
             },
             async pull(streamController) {
                 try {
-                    controller.signal.throwIfAborted();
+                    signal.throwIfAborted();
                     const { done, value } = await reader.read();
                     if (bodySettled)
                         return;
-                    controller.signal.throwIfAborted();
+                    signal.throwIfAborted();
                     if (done) {
                         bodySettled = true;
                         clearIdleTimeout();
+                        signal.removeEventListener("abort", abortBody);
                         streamController.close();
                     }
                     else {
@@ -186,12 +218,14 @@ export async function fetchS3WithTimeout(url, init, timeoutMs, trustedPrivateOri
                         return;
                     bodySettled = true;
                     clearIdleTimeout();
-                    streamController.error(controller.signal.aborted ? controller.signal.reason : error);
+                    signal.removeEventListener("abort", abortBody);
+                    streamController.error(signal.aborted ? signal.reason : error);
                 }
             },
             async cancel(reason) {
                 bodySettled = true;
                 clearIdleTimeout();
+                signal.removeEventListener("abort", abortBody);
                 await reader.cancel(reason);
             },
         }, { highWaterMark: 0 });
@@ -203,6 +237,8 @@ export async function fetchS3WithTimeout(url, init, timeoutMs, trustedPrivateOri
     }
     catch (err) {
         clearTimeoutIfRunning();
+        if (abortHeaders)
+            signal.removeEventListener("abort", abortHeaders);
         if (err instanceof Error && err.name === "TimeoutError") {
             throw createTimeoutError(headersTimeoutMs);
         }
@@ -352,12 +388,31 @@ export async function signS3Request(config, key, options) {
         headers,
     };
 }
+async function signS3RequestWithSignal(config, key, options) {
+    const signal = options.signal;
+    if (!signal)
+        return signS3Request(config, key, options);
+    signal.throwIfAborted();
+    let abort;
+    const aborted = new Promise((_, reject) => {
+        abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+    });
+    try {
+        return await Promise.race([signS3Request(config, key, options), aborted]);
+    }
+    finally {
+        if (abort)
+            signal.removeEventListener("abort", abort);
+    }
+}
 /**
  * Sends a SigV4-signed request through the SSRF guard. Requests carry signed
  * credentials and private bytes, so only the deployment's own endpoint and
  * keys may sit on a private network or use plain HTTP.
  */
 export async function signedS3Request(config, key, options) {
+    options.signal?.throwIfAborted();
     const trustedOrigin = options.trustedEndpoint
         ? new URL(config.endpoint).origin
         : usesDeploymentS3Keys(config)
@@ -366,10 +421,12 @@ export async function signedS3Request(config, key, options) {
     if (new URL(config.endpoint).protocol !== "https:" && !trustedOrigin) {
         throw new Error("Storage endpoints saved in settings must use HTTPS");
     }
-    const { url, headers } = await signS3Request(config, key, options);
+    const { url, headers } = await signS3RequestWithSignal(config, key, options);
+    options.signal?.throwIfAborted();
     return fetchS3WithTimeout(url, {
         method: options.method,
         headers,
+        signal: options.signal,
         ...(options.body
             ? {
                 body: options.body.buffer.slice(options.body.byteOffset, options.body.byteOffset + options.body.byteLength),

package/dist/file-upload/s3.d.ts

@@ -1,3 +1,12 @@
 import type { FileUploadProvider } from "./types.js";
+/**
+ * A request the bucket answered with an error. `status` lets callers tell a
+ * refused bucket (401, 403, or 404 for a missing bucket) from an outage.
+ */
+export declare class S3RequestError extends Error {
+    readonly provider = "s3";
+    readonly status: number;
+    constructor(message: string, status: number);
+}
 export declare const s3FileUploadProvider: FileUploadProvider;
 export declare function ensureS3FileUploadProvider(): void;

package/dist/file-upload/s3.js

@@ -103,6 +103,19 @@ async function readRequestConfig() {
     await prefetchSecrets(STORAGE_SECRET_KEYS);
     return (await readSavedConfig()) ?? readEnvConfig();
 }
+/**
+ * A request the bucket answered with an error. `status` lets callers tell a
+ * refused bucket (401, 403, or 404 for a missing bucket) from an outage.
+ */
+export class S3RequestError extends Error {
+    provider = "s3";
+    status;
+    constructor(message, status) {
+        super(message);
+        this.name = "S3RequestError";
+        this.status = status;
+    }
+}
 const PUT_TIMEOUT_MS = 120_000;
 const DELETE_TIMEOUT_MS = 30_000;
 function encodeKey(key) {
@@ -117,7 +130,7 @@ async function putObject(config, key, data, contentType) {
     });
     if (!response.ok) {
         const detail = await readS3ErrorText(response);
-        throw new Error(`S3 PutObject failed (${response.status}): ${detail || response.statusText}`);
+        throw new S3RequestError(`S3 PutObject failed (${response.status}): ${detail || response.statusText}`, response.status);
     }
     await cancelS3ResponseBody(response);
     return `${config.publicBaseUrl}/${encodeKey(key)}`;

package/dist/framework-package-versions.json

@@ -1,17 +1,17 @@
 {
-  "@agent-native/agentkit": "0.227.0",
+  "@agent-native/agentkit": "0.228.0-nightly-20261111004142",
   "@agent-native/code-agents-ui": "0.1.75",
-  "@agent-native/core": "0.227.0",
-  "@agent-native/core-corpus": "0.227.0",
+  "@agent-native/core": "0.228.0-nightly-20261111004142",
+  "@agent-native/core-corpus": "0.228.0-nightly-20261111004142",
   "@agent-native/creative-context": "0.8.69",
-  "@agent-native/dispatch": "0.42.4",
+  "@agent-native/dispatch": "0.42.5-nightly-20261111004142",
   "@agent-native/embedding": "0.2.0",
   "@agent-native/migrate": "0.0.7",
   "@agent-native/otel": "0.1.36",
   "@agent-native/pinpoint": "0.1.112",
-  "@agent-native/recap-cli": "0.5.100",
-  "@agent-native/scheduling": "0.2.56",
+  "@agent-native/recap-cli": "0.5.101-nightly-20261111004142",
+  "@agent-native/scheduling": "0.2.57-nightly-20261111004142",
   "@agent-native/shared-app-config": "0.1.2",
-  "@agent-native/skills": "0.4.4",
-  "@agent-native/toolkit": "0.227.0"
+  "@agent-native/skills": "0.4.5-nightly-20261111004142",
+  "@agent-native/toolkit": "0.228.0-nightly-20261111004142"
 }