@agent-native/core 0.51.15 → 0.53.0

package/dist/server/core-routes-plugin.js

@@ -40,9 +40,10 @@ import { runWithRequestContext } from "./request-context.js";
 import { createVoiceProvidersStatusHandler } from "./voice-providers-status.js";
 import { PROVIDER_ENV_META } from "../agent/engine/provider-env-vars.js";
 import { DEFAULT_MODEL } from "../agent/default-model.js";
-import { canUseDeployCredentialFallbackForRequest } from "./credential-provider.js";
+import { canUseDeployCredentialFallbackForRequest, resolveSecret, } from "./credential-provider.js";
+import { createAgentEngineApiKeyHandler } from "./agent-engine-api-key-route.js";
 import { canUpdateAgentLoopSettings, readAgentLoopSettings, resetAgentLoopSettings, validateMaxIterationsInput, writeAgentLoopSettings, } from "../agent/loop-settings.js";
-import { isAgentEngineSettingConfigured, getAgentEngineEntry, detectEngineFromEnv, detectEngineFromUserSecrets, isAgentEnginePackageInstalled, isStoredEngineUsableForRequest, } from "../agent/engine/registry.js";
+import { isAgentEngineSettingConfigured, getAgentEngineEntry, detectEngineFromEnv, detectEngineFromUserSecrets, isStoredEngineUsableForRequest, } from "../agent/engine/registry.js";
 import { registerBuiltinEngines } from "../agent/engine/builtin.js";
 import { getOrgContext } from "../org/context.js";
 import { isEnvVarWriteAllowed } from "./env-var-writes.js";
@@ -97,7 +98,9 @@ async function detectUsageEngineName(event, userEmail) {
             ? getAgentEngineEntry(process.env.AGENT_ENGINE)
             : undefined;
         if (envEntry) {
-            return isAgentEnginePackageInstalled(envEntry) ? envEntry.name : null;
+            return (await runWithRequestContext({ userEmail, orgId }, () => isStoredEngineUsableForRequest({ engine: envEntry.name }, envEntry)))
+                ? envEntry.name
+                : null;
         }
         const detectedFromUser = await runWithRequestContext({ userEmail, orgId }, () => detectEngineFromUserSecrets());
         if (detectedFromUser?.name === "builder")
@@ -1410,17 +1413,19 @@ export function createCoreRoutesPlugin(options = {}) {
                             /* org module not present in this template */
                         }
                     }
-                    const canUseDeployEnv = await runWithRequestContext({ userEmail, orgId }, () => canUseDeployCredentialFallbackForRequest());
-                    return envKeys.map((cfg) => {
+                    return Promise.all(envKeys.map(async (cfg) => {
                         const isProviderKey = PROVIDER_ENV_VAR_KEYS.has(cfg.key);
+                        const configured = isProviderKey
+                            ? await runWithRequestContext({ userEmail, orgId }, () => resolveSecret(cfg.key).then(Boolean))
+                            : !!process.env[cfg.key];
                         return {
                             key: cfg.key,
                             label: cfg.label,
                             required: cfg.required ?? false,
-                            configured: !!process.env[cfg.key] && (!isProviderKey || canUseDeployEnv),
+                            configured,
                             ...(cfg.helpText ? { helpText: cfg.helpText } : {}),
                         };
-                    });
+                    }));
                 }));
                 getH3App(nitroApp).use(`${P}/env-vars`, defineEventHandler(async (event) => {
                     if (getMethod(event) !== "POST") {
@@ -1432,11 +1437,11 @@ export function createCoreRoutesPlugin(options = {}) {
                     // write here lets one tenant overwrite Stripe / OpenAI / Sentry
                     // keys for every other tenant. Disable the endpoint outside of
                     // local-dev SQLite or an explicit single-tenant opt-in, and
-                    // direct callers to the per-org credential store instead.
+                    // direct callers to scoped secret/credential stores instead.
                     if (!isEnvVarWriteAllowed()) {
                         setResponseStatus(event, 403);
                         return {
-                            error: "env-vars endpoint disabled on multi-tenant deployments. Use saveCredential(key, value, { userEmail, orgId, scope: 'org' }) to store per-org credentials.",
+                            error: "env-vars endpoint disabled on multi-tenant deployments. Use scoped secrets or credentials for user/org API keys.",
                         };
                     }
                     const body = await readBody(event);
@@ -1503,6 +1508,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     return { saved: filtered.map((v) => v.key) };
                 }));
             }
+            getH3App(nitroApp).use(`${P}/agent-engine/api-key`, createAgentEngineApiKeyHandler());
             // GET /_agent-native/agent-engine/status — reports whether an engine
             // is configured (settings row, settings+env, or auto-detected from env).
             // The agent-chat UI uses this to skip the onboarding gate for providers
@@ -1536,7 +1542,8 @@ export function createCoreRoutesPlugin(options = {}) {
                         ? getAgentEngineEntry(process.env.AGENT_ENGINE)
                         : undefined;
                     if (envEntry) {
-                        if (!isAgentEnginePackageInstalled(envEntry)) {
+                        const envUsable = await runWithRequestContext({ userEmail, orgId }, () => isStoredEngineUsableForRequest({ engine: envEntry.name }, envEntry));
+                        if (!envUsable) {
                             return { configured: false };
                         }
                         return {