@agent-native/core 0.52.0 → 0.53.0

package/dist/server/core-routes-plugin.js

@@ -43,7 +43,7 @@ import { DEFAULT_MODEL } from "../agent/default-model.js";
 import { canUseDeployCredentialFallbackForRequest, resolveSecret, } from "./credential-provider.js";
 import { createAgentEngineApiKeyHandler } from "./agent-engine-api-key-route.js";
 import { canUpdateAgentLoopSettings, readAgentLoopSettings, resetAgentLoopSettings, validateMaxIterationsInput, writeAgentLoopSettings, } from "../agent/loop-settings.js";
-import { isAgentEngineSettingConfigured, getAgentEngineEntry, detectEngineFromEnv, detectEngineFromUserSecrets, isAgentEnginePackageInstalled, isStoredEngineUsableForRequest, } from "../agent/engine/registry.js";
+import { isAgentEngineSettingConfigured, getAgentEngineEntry, detectEngineFromEnv, detectEngineFromUserSecrets, isStoredEngineUsableForRequest, } from "../agent/engine/registry.js";
 import { registerBuiltinEngines } from "../agent/engine/builtin.js";
 import { getOrgContext } from "../org/context.js";
 import { isEnvVarWriteAllowed } from "./env-var-writes.js";
@@ -98,7 +98,9 @@ async function detectUsageEngineName(event, userEmail) {
             ? getAgentEngineEntry(process.env.AGENT_ENGINE)
             : undefined;
         if (envEntry) {
-            return isAgentEnginePackageInstalled(envEntry) ? envEntry.name : null;
+            return (await runWithRequestContext({ userEmail, orgId }, () => isStoredEngineUsableForRequest({ engine: envEntry.name }, envEntry)))
+                ? envEntry.name
+                : null;
         }
         const detectedFromUser = await runWithRequestContext({ userEmail, orgId }, () => detectEngineFromUserSecrets());
         if (detectedFromUser?.name === "builder")
@@ -1435,7 +1437,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     // write here lets one tenant overwrite Stripe / OpenAI / Sentry
                     // keys for every other tenant. Disable the endpoint outside of
                     // local-dev SQLite or an explicit single-tenant opt-in, and
-                    // direct callers to the per-org credential store instead.
+                    // direct callers to scoped secret/credential stores instead.
                     if (!isEnvVarWriteAllowed()) {
                         setResponseStatus(event, 403);
                         return {
@@ -1540,7 +1542,8 @@ export function createCoreRoutesPlugin(options = {}) {
                         ? getAgentEngineEntry(process.env.AGENT_ENGINE)
                         : undefined;
                     if (envEntry) {
-                        if (!isAgentEnginePackageInstalled(envEntry)) {
+                        const envUsable = await runWithRequestContext({ userEmail, orgId }, () => isStoredEngineUsableForRequest({ engine: envEntry.name }, envEntry));
+                        if (!envUsable) {
                             return { configured: false };
                         }
                         return {