@agent-native/core 0.7.14 → 0.7.16

package/dist/agent/production-agent.d.ts

@@ -1,6 +1,6 @@
 import type { EventHandler as H3EventHandler } from "h3";
-import type { ActionTool, AgentChatEvent } from "./types.js";
-import type { AgentEngine, EngineTool, EngineMessage } from "./engine/types.js";
+import type { ActionTool, AgentChatAttachment, AgentChatEvent } from "./types.js";
+import type { AgentEngine, EngineTool, EngineMessage, EngineContentPart } from "./engine/types.js";
 import { PROVIDER_TO_ENV } from "./engine/provider-env-vars.js";
 import { subscribeToRun, getActiveRunForThread, getActiveRunForThreadAsync, getRun, abortRun } from "./run-manager.js";
 import type { ActiveRun } from "./run-manager.js";
@@ -9,6 +9,12 @@ export { PROVIDER_TO_ENV };
  * Look up a user's persisted API key for the given provider. Returns
  * `undefined` for unauthenticated/local callers so the shared platform key
  * is never keyed off `local@localhost` in multi-tenant deployments.
+ *
+ * Read order:
+ *   1. `app_secrets` — encrypted, scope=user, current source of truth.
+ *   2. Legacy `user-api-key:<provider>:<email>` settings row — pre-migration
+ *      data that hasn't been backfilled yet. Surfaced for compat only;
+ *      writes always go to app_secrets now.
  */
 export declare function getOwnerApiKey(provider: string, ownerEmail: string | null | undefined): Promise<string | undefined>;
 /**
@@ -18,7 +24,19 @@ export declare function getOwnerApiKey(provider: string, ownerEmail: string | nu
 export declare function engineToProvider(engineName: string): string;
 /**
  * Resolve the active engine's provider and look up the user's API key for it.
- * Falls back to the provider's env var if no per-user key is stored.
+ *
+ * In multi-tenant deploys we deliberately refuse the deploy-level
+ * deploy-level fallback for authenticated users. Without that gate any
+ * signed-in user who hasn't configured their own provider key would silently
+ * inherit the deployment's key (uncapped billing on the owner's account,
+ * prompt logging tied to the deployment owner) — exactly the prior-incident
+ * pattern we hit on 2026-04-29.
+ *
+ * Single-tenant (local-dev, self-hosted SQLite) keeps the env fallback.
+ *
+ * Callers in `agent-chat-plugin.ts`, `triggers/dispatcher.ts`,
+ * `jobs/scheduler.ts`, and `integrations/plugin.ts` historically layer
+ * another deployment-key fallback after this must keep the same gate.
  */
 export declare function getOwnerActiveApiKey(ownerEmail: string | null | undefined): Promise<string | undefined>;
 /** @deprecated Use getOwnerApiKey("anthropic", ownerEmail) instead */
@@ -36,6 +54,13 @@ export interface ActionEntry {
     /** If true, completion does NOT trigger a screen-refresh poll event.
      *  Set automatically by `defineAction` when `http.method === "GET"`. */
     readOnly?: boolean;
+    /** Whether this action may be invoked from the tools-iframe bridge.
+     *  **Default-allow opt-out**: only an explicit `false` returns 403.
+     *  - `true` / `undefined` — allow.
+     *  - `false` — explicit deny; the tools bridge returns 403.
+     *  See `defineAction` (`packages/core/src/action.ts`) and audit H5 in
+     *  `security-audit/05-tools-sandbox.md`. */
+    toolCallable?: boolean;
 }
 /** @deprecated Use `ActionEntry` instead */
 export type ScriptEntry = ActionEntry;
@@ -69,10 +94,6 @@ export interface ProductionAgentOptions {
     onEngineResolved?: (engine: AgentEngine, model: string) => void;
     /** Resolve the owner email from the H3 event (for usage tracking) */
     resolveOwnerEmail?: (event: any) => string | Promise<string>;
-    /** Enable per-user usage limit checking and token tracking */
-    trackUsage?: boolean;
-    /** Usage limit in cents (default: 100 = $1.00) */
-    usageLimitCents?: number;
     /**
      * Skip auto-injecting the workspace files/skills/agents inventory on the
      * first message of a conversation. Useful for minimal/voice apps where
@@ -81,6 +102,10 @@ export interface ProductionAgentOptions {
      */
     skipFilesContext?: boolean;
 }
+export declare function buildUserContentWithAttachments(opts: {
+    text: string;
+    attachments?: AgentChatAttachment[];
+}): EngineContentPart[];
 /** Accumulated token usage from an agent loop run */
 export interface AgentLoopUsage {
     inputTokens: number;

package/dist/agent/production-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"production-agent.d.ts","sourceRoot":"","sources":["../../src/agent/production-agent.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,IAAI,cAAc,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,KAAK,EACV,UAAU,EAEV,cAAc,EAEf,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,aAAa,EAEd,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EAEL,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,MAAM,EACN,QAAQ,EACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAQlD,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAmB7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAc7B;AAED,sEAAsE;AACtE,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,CACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,CAAC,EAAE,gBAAgB,KACvB,OAAO,CAAC,GAAG,CAAC,CAAC;IAClB,qFAAqF;IACrF,IAAI,CAAC,EAAE,OAAO,cAAc,EAAE,gBAAgB,GAAG,KAAK,CAAC;IACvD;4EACwE;IACxE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC;AAEtC,MAAM,WAAW,sBAAsB;IACrC,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtC,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtC,0FAA0F;IAC1F,YAAY,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,CAAC,EACH,WAAW,GACX,MAAM,GACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,eAAe,CAAC,EAAE,aAAa,SAAS,KAAK,GAAG,KAAK,GAAG,GAAG,CAAC;IAC5D,uEAAuE;IACvE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IACvE,4FAA4F;IAC5F,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,EACrC,QAAQ,EAAE,MAAM,KACb,IAAI,CAAC;IACV;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAChE,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,8DAA8D;IAC9D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,kDAAkD;IAClD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAoGD,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,UAAU,EAAE,CASd;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;IACtC,MAAM,EAAE,WAAW,CAAC;IACpB,eAAe,CAAC,EAAE,GAAG,CAAC;CACvB,GAAG,OAAO,CAAC,cAAc,CAAC,CAkL1B;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,sBAAsB,GAC9B,cAAc,CAsuBhB;AAED,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,MAAM,EACN,QAAQ,EACR,cAAc,GACf,CAAC"}
+{"version":3,"file":"production-agent.d.ts","sourceRoot":"","sources":["../../src/agent/production-agent.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,IAAI,cAAc,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,KAAK,EACV,UAAU,EACV,mBAAmB,EAEnB,cAAc,EAEf,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,aAAa,EACb,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EAEL,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,MAAM,EACN,QAAQ,EACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAQlD,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA+B7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAuBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqB7B;AAED,sEAAsE;AACtE,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,CACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,CAAC,EAAE,gBAAgB,KACvB,OAAO,CAAC,GAAG,CAAC,CAAC;IAClB,qFAAqF;IACrF,IAAI,CAAC,EAAE,OAAO,cAAc,EAAE,gBAAgB,GAAG,KAAK,CAAC;IACvD;4EACwE;IACxE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;gDAK4C;IAC5C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC;AAEtC,MAAM,WAAW,sBAAsB;IACrC,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtC,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtC,0FAA0F;IAC1F,YAAY,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,CAAC,EACH,WAAW,GACX,MAAM,GACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,eAAe,CAAC,EAAE,aAAa,SAAS,KAAK,GAAG,KAAK,GAAG,GAAG,CAAC;IAC5D,uEAAuE;IACvE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IACvE,4FAA4F;IAC5F,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,EACrC,QAAQ,EAAE,MAAM,KACb,IAAI,CAAC;IACV;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAChE,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAkGD,wBAAgB,+BAA+B,CAAC,IAAI,EAAE;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACrC,GAAG,iBAAiB,EAAE,CAgCtB;AA8DD,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,UAAU,EAAE,CASd;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;IACtC,MAAM,EAAE,WAAW,CAAC;IACpB,eAAe,CAAC,EAAE,GAAG,CAAC;CACvB,GAAG,OAAO,CAAC,cAAc,CAAC,CAqM1B;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,sBAAsB,GAC9B,cAAc,CAquBhB;AAED,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,MAAM,EACN,QAAQ,EACR,cAAc,GACf,CAAC"}

package/dist/agent/production-agent.js

@@ -1,4 +1,7 @@
 import { defineEventHandler, setResponseHeader, setResponseStatus, getMethod, } from "h3";
+import { DEV_MODE_USER_EMAIL } from "../server/auth.js";
+import { isLocalDatabase } from "../db/client.js";
+import { readDeployCredentialEnv } from "../server/credential-provider.js";
 import { EngineError } from "./engine/types.js";
 import { resolveEngine, registerBuiltinEngines, getStoredModelForEngine, } from "./engine/index.js";
 import { PROVIDER_TO_ENV } from "./engine/provider-env-vars.js";
@@ -14,17 +17,36 @@ export { PROVIDER_TO_ENV };
  * Look up a user's persisted API key for the given provider. Returns
  * `undefined` for unauthenticated/local callers so the shared platform key
  * is never keyed off `local@localhost` in multi-tenant deployments.
+ *
+ * Read order:
+ *   1. `app_secrets` — encrypted, scope=user, current source of truth.
+ *   2. Legacy `user-api-key:<provider>:<email>` settings row — pre-migration
+ *      data that hasn't been backfilled yet. Surfaced for compat only;
+ *      writes always go to app_secrets now.
  */
 export async function getOwnerApiKey(provider, ownerEmail) {
-    if (!ownerEmail || ownerEmail === "local@localhost")
+    if (!ownerEmail || ownerEmail === DEV_MODE_USER_EMAIL)
         return undefined;
+    const secretKey = PROVIDER_TO_ENV[provider] ?? `${provider.toUpperCase()}_API_KEY`;
+    try {
+        const { readAppSecret } = await import("../secrets/storage.js");
+        const fromSecrets = await readAppSecret({
+            key: secretKey,
+            scope: "user",
+            scopeId: ownerEmail,
+        });
+        if (fromSecrets?.value)
+            return fromSecrets.value;
+    }
+    catch {
+        // app_secrets table not ready — fall through to legacy lookup.
+    }
     try {
         const { getSetting } = await import("../settings/store.js");
         const stored = await getSetting(`user-api-key:${provider}:${ownerEmail}`);
         const key = stored && typeof stored.key === "string" ? stored.key.trim() : "";
         if (key)
             return key;
-        // Backward compat: check legacy Anthropic key format
         if (provider === "anthropic") {
             const legacy = await getSetting(`user-anthropic-api-key:${ownerEmail}`);
             const legacyKey = legacy && typeof legacy.key === "string" ? legacy.key.trim() : "";
@@ -43,9 +65,42 @@ export async function getOwnerApiKey(provider, ownerEmail) {
 export function engineToProvider(engineName) {
     return engineName.startsWith("ai-sdk:") ? engineName.slice(7) : engineName;
 }
+/**
+ * Returns true when this process is acting as a multi-tenant deployment —
+ * i.e. a hosted shared-DB environment where one user's identity must NOT be
+ * silently substituted with the deploy-level API key.
+ *
+ * Mirrors the gate in `resolveBuilderCredential` (server/credential-provider.ts).
+ *
+ * Heuristic:
+ *   - `NODE_ENV === "production"`, AND
+ *   - The DB is not a local file (i.e. it's Neon/Postgres/Turso/D1 — any
+ *     backend that could be shared across multiple users).
+ *
+ * Self-hosted single-tenant deployments (a local sqlite file, or NODE_ENV
+ * unset/development) keep the env-var fallback so the original BYO-server
+ * UX continues to work without a per-user key.
+ */
+function isMultiTenantDeploy() {
+    if (process.env.NODE_ENV !== "production")
+        return false;
+    return !isLocalDatabase();
+}
 /**
  * Resolve the active engine's provider and look up the user's API key for it.
- * Falls back to the provider's env var if no per-user key is stored.
+ *
+ * In multi-tenant deploys we deliberately refuse the deploy-level
+ * deploy-level fallback for authenticated users. Without that gate any
+ * signed-in user who hasn't configured their own provider key would silently
+ * inherit the deployment's key (uncapped billing on the owner's account,
+ * prompt logging tied to the deployment owner) — exactly the prior-incident
+ * pattern we hit on 2026-04-29.
+ *
+ * Single-tenant (local-dev, self-hosted SQLite) keeps the env fallback.
+ *
+ * Callers in `agent-chat-plugin.ts`, `triggers/dispatcher.ts`,
+ * `jobs/scheduler.ts`, and `integrations/plugin.ts` historically layer
+ * another deployment-key fallback after this must keep the same gate.
  */
 export async function getOwnerActiveApiKey(ownerEmail) {
     try {
@@ -56,8 +111,15 @@ export async function getOwnerActiveApiKey(ownerEmail) {
         const userKey = await getOwnerApiKey(provider, ownerEmail);
         if (userKey)
             return userKey;
+        if (isMultiTenantDeploy()) {
+            // Multi-tenant: refuse the env fallback. A null user (unauthenticated /
+            // background context with no owner) gets undefined here too — there's
+            // no user to bill, and the call site must surface a "configure a key"
+            // error to the requester rather than silently using the deploy key.
+            return undefined;
+        }
         const envVar = PROVIDER_TO_ENV[provider];
-        return envVar ? process.env[envVar] || undefined : undefined;
+        return envVar ? readDeployCredentialEnv(envVar) : undefined;
     }
     catch {
         return undefined;
@@ -74,6 +136,23 @@ function generateRunId() {
     return `run-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
 }
 /** Check if an error is transient and should be retried */
+function isContextTooLongError(err) {
+    if (!(err instanceof Error))
+        return false;
+    const msg = err.message.toLowerCase();
+    if (msg.includes("context_length_exceeded") ||
+        msg.includes("input_too_long") ||
+        msg.includes("too many tokens") ||
+        msg.includes("prompt is too long") ||
+        msg.includes("reduce the length"))
+        return true;
+    if (err instanceof EngineError) {
+        const code = (err.errorCode ?? "").toLowerCase();
+        if (code.includes("context_length") || code.includes("input_too_long"))
+            return true;
+    }
+    return false;
+}
 function isRetryableError(err) {
     if (!(err instanceof Error))
         return false;
@@ -97,6 +176,59 @@ function retryDelay(attempt, signal) {
         }, { once: true });
     });
 }
+function isSupportedImageMediaType(mediaType) {
+    return (mediaType === "image/jpeg" ||
+        mediaType === "image/png" ||
+        mediaType === "image/gif" ||
+        mediaType === "image/webp");
+}
+function escapeAttachmentAttribute(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/"/g, "&quot;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;");
+}
+function formatTextAttachment(att) {
+    if (typeof att.text !== "string" || att.text.length === 0)
+        return null;
+    const attrs = [
+        `name="${escapeAttachmentAttribute(att.name || "attachment")}"`,
+        att.contentType
+            ? `contentType="${escapeAttachmentAttribute(att.contentType)}"`
+            : null,
+        att.type ? `type="${escapeAttachmentAttribute(att.type)}"` : null,
+    ].filter(Boolean);
+    return `<attachment ${attrs.join(" ")}>\n${att.text}\n</attachment>`;
+}
+export function buildUserContentWithAttachments(opts) {
+    const userContent = [];
+    const textAttachments = [];
+    for (const att of opts.attachments ?? []) {
+        if (att.type === "image" && att.data) {
+            const match = att.data.match(/^data:(image\/[^;]+);base64,(.+)$/);
+            if (match && isSupportedImageMediaType(match[1])) {
+                userContent.push({
+                    type: "image",
+                    data: match[2],
+                    mediaType: match[1],
+                });
+            }
+            continue;
+        }
+        const textAttachment = formatTextAttachment(att);
+        if (textAttachment) {
+            textAttachments.push(textAttachment);
+        }
+    }
+    userContent.push({
+        type: "text",
+        text: textAttachments.length > 0
+            ? `${textAttachments.join("\n\n")}\n\n${opts.text}`
+            : opts.text,
+    });
+    return userContent;
+}
 /** Build enriched message with file/skill/mention references */
 function enrichMessage(message, references) {
     if (references.length === 0)
@@ -215,6 +347,9 @@ export async function runAgentLoop(opts) {
             catch (err) {
                 if (signal.aborted)
                     throw err;
+                if (isContextTooLongError(err)) {
+                    throw new EngineError("Conversation has grown too long. Start a new conversation to continue.", { errorCode: "context_length_exceeded" });
+                }
                 if (retry < MAX_RETRIES && isRetryableError(err)) {
                     // Clear partial text from the failed attempt so the retry
                     // doesn't produce garbled duplicate output
@@ -262,11 +397,24 @@ export async function runAgentLoop(opts) {
                 tool: toolCall.name,
                 input: toolCall.input,
             });
+            const MAX_TOOL_RESULT_CHARS = 50_000;
+            const TOOL_TIMEOUT_MS = 60_000;
             let result;
             let isError = false;
             try {
-                const raw = await actionEntry.run(toolCall.input, { send });
-                result = typeof raw === "string" ? raw : JSON.stringify(raw, null, 2);
+                const timeoutSignal = AbortSignal.timeout(TOOL_TIMEOUT_MS);
+                const raw = await Promise.race([
+                    actionEntry.run(toolCall.input, { send }),
+                    new Promise((_, reject) => {
+                        timeoutSignal.addEventListener("abort", () => reject(new Error("Tool call timed out after 60 seconds")));
+                    }),
+                ]);
+                let resultStr = typeof raw === "string" ? raw : JSON.stringify(raw, null, 2);
+                if (resultStr.length > MAX_TOOL_RESULT_CHARS) {
+                    const truncated = resultStr.slice(0, MAX_TOOL_RESULT_CHARS);
+                    resultStr = `${truncated}\n\n...[truncated — full result was ${resultStr.length.toLocaleString()} chars; only first ${MAX_TOOL_RESULT_CHARS.toLocaleString()} shown]`;
+                }
+                result = resultStr;
             }
             catch (err) {
                 result = `Error running ${toolCall.name}: ${err?.message ?? String(err)}`;
@@ -344,9 +492,8 @@ export function createProductionAgentHandler(options) {
             return { error: "message is required" };
         }
         // Resolve owner first so we can look up a per-owner API key. Users
-        // who bring their own key bypass the platform's free-tier usage limit
-        // and use their key for this request (which is also durable across
-        // serverless cold starts via the settings table).
+        // who bring their own key use their key for this request (durable
+        // across serverless cold starts via the settings table).
         let ownerEmail = null;
         if (options.resolveOwnerEmail) {
             try {
@@ -362,15 +509,28 @@ export function createProductionAgentHandler(options) {
         if (requestEngine) {
             const provider = engineToProvider(requestEngine);
             userApiKey = await getOwnerApiKey(provider, ownerEmail);
-            if (!userApiKey) {
+            if (!userApiKey && !isMultiTenantDeploy()) {
+                // Single-tenant only: env fallback for the requested provider.
+                // Multi-tenant deploys never silently substitute the deploy-level
+                // key for an authenticated user (see getOwnerActiveApiKey for the
+                // full rationale).
                 const envVar = PROVIDER_TO_ENV[provider];
-                userApiKey = envVar ? process.env[envVar] || undefined : undefined;
+                userApiKey = envVar ? readDeployCredentialEnv(envVar) : undefined;
             }
         }
         else {
             userApiKey = await getOwnerActiveApiKey(ownerEmail);
         }
-        const effectiveApiKey = userApiKey ?? options.apiKey ?? process.env.ANTHROPIC_API_KEY;
+        // `options.apiKey` is the value the template constructed the plugin with
+        // (e.g. wired from a deployment env var). On a multi-tenant deploy this
+        // is the same cross-tenant hazard as any deploy-level provider key:
+        // accepting it as the final fallback would silently bill every key-less
+        // user to the deployment's account. Only honour it in single-tenant mode.
+        const effectiveApiKey = isMultiTenantDeploy()
+            ? userApiKey
+            : (userApiKey ??
+                options.apiKey ??
+                readDeployCredentialEnv("ANTHROPIC_API_KEY"));
         // Resolve engine — per-request engine override takes priority
         let engine;
         try {
@@ -414,34 +574,6 @@ export function createProductionAgentHandler(options) {
                 },
             });
         }
-        // Check usage limit before starting a run (production hosted mode).
-        // Skip when the user has provided their own key — they're paying
-        // Anthropic directly, so the platform's free tier doesn't apply.
-        if (!userApiKey &&
-            options.trackUsage &&
-            options.resolveOwnerEmail &&
-            ownerEmail &&
-            ownerEmail !== "local@localhost") {
-            try {
-                const { checkUsageLimit } = await import("../usage/store.js");
-                const result = await checkUsageLimit(ownerEmail, options.usageLimitCents);
-                if (!result.allowed) {
-                    setResponseHeader(event, "Content-Type", "text/event-stream");
-                    setResponseHeader(event, "Cache-Control", "no-cache");
-                    setResponseHeader(event, "Connection", "keep-alive");
-                    const encoder = new TextEncoder();
-                    return new ReadableStream({
-                        start(controller) {
-                            controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: "usage_limit_reached", usageCents: result.usageCents, limitCents: result.limitCents })}\n\n`));
-                            controller.close();
-                        },
-                    });
-                }
-            }
-            catch {
-                // Usage check failed — allow the request to proceed
-            }
-        }
         // Run all independent pre-send steps in parallel. Each of these hits
         // the DB or invokes an action; running them sequentially was the
         // single biggest contributor to pre-LLM latency.
@@ -504,6 +636,27 @@ export function createProductionAgentHandler(options) {
             }
             return "";
         })();
+        // Selection context: written by the client when the user presses Cmd+I
+        // with text selected on the page. Treat anything older than 5 minutes
+        // as stale and ignore it.
+        const SELECTION_TTL_MS = 5 * 60 * 1000;
+        const selectionContextPromise = (async () => {
+            try {
+                const sel = (await readAppState("pending-selection-context"));
+                if (!sel?.text)
+                    return "";
+                const capturedAt = typeof sel.capturedAt === "number" ? sel.capturedAt : 0;
+                if (Date.now() - capturedAt > SELECTION_TTL_MS)
+                    return "";
+                return (`\n\nThe user has selected the following text and pressed Cmd+I to focus the agent. ` +
+                    `Treat this as the immediate context to act on:\n` +
+                    `<selection>\n${sel.text}\n</selection>`);
+            }
+            catch {
+                // DB not ready — skip silently
+            }
+            return "";
+        })();
         // On the first message of a conversation, inject workspace inventory
         // so the agent knows what files, skills, jobs, and custom agents exist.
         // Templates can opt out via `skipFilesContext: true` when the inventory
@@ -516,7 +669,9 @@ export function createProductionAgentHandler(options) {
                 try {
                     const { resourceListAccessible, SHARED_OWNER, resourceGet } = await import("../resources/store.js");
                     const { getResourceKind, parseCustomAgentProfile, parseRemoteAgentManifest, parseSkillMetadata, } = await import("../resources/metadata.js");
-                    const ownerEmail = getRequestUserEmail() || "local@localhost";
+                    const ownerEmail = getRequestUserEmail();
+                    if (!ownerEmail)
+                        throw new Error("no authenticated user");
                     const allResources = await resourceListAccessible(ownerEmail);
                     if (allResources.length > 0) {
                         const fileLines = [];
@@ -577,10 +732,11 @@ export function createProductionAgentHandler(options) {
             }
             return filesContext;
         })();
-        const [systemPrompt, screenBlock, urlBlock, filesContext] = await Promise.all([
+        const [systemPrompt, screenBlock, urlBlock, selectionBlock, filesContext] = await Promise.all([
             systemPromptPromise,
             screenContextPromise,
             urlContextPromise,
+            selectionContextPromise,
             filesContextPromise,
         ]);
         if (systemPromptError) {
@@ -595,29 +751,13 @@ export function createProductionAgentHandler(options) {
                 },
             });
         }
-        const screenContext = screenBlock + urlBlock;
+        const screenContext = screenBlock + urlBlock + selectionBlock;
         // Pre-compute agent references for A2A resolution inside the run
         const agentRefs = references.filter((r) => r.type === "agent");
         const customAgentRefs = references.filter((r) => r.type === "custom-agent");
-        // Build user content: text + any image attachments
-        const userContent = [];
-        if (attachments?.length) {
-            for (const att of attachments) {
-                if (att.type === "image" && att.data) {
-                    const match = att.data.match(/^data:(image\/[^;]+);base64,(.+)$/);
-                    if (match) {
-                        userContent.push({
-                            type: "image",
-                            data: match[2],
-                            mediaType: match[1],
-                        });
-                    }
-                }
-            }
-        }
-        userContent.push({
-            type: "text",
+        const userContent = buildUserContentWithAttachments({
             text: enrichedMessage + screenContext + filesContext,
+            attachments,
         });
         const messages = [
             ...history
@@ -628,6 +768,18 @@ export function createProductionAgentHandler(options) {
             })),
             { role: "user", content: userContent },
         ];
+        // If there's already an active run for this thread, reject with 409 so
+        // the client can queue or wait rather than silently aborting the existing run.
+        if (threadId) {
+            const existingRun = getActiveRunForThread(threadId);
+            if (existingRun && existingRun.status === "running") {
+                setResponseStatus(event, 409);
+                return {
+                    error: "Run already in progress for this thread",
+                    activeRunId: existingRun.runId,
+                };
+            }
+        }
         // Start agent loop in background via run-manager
         const runId = generateRunId();
         startRun(runId, threadId ?? runId, async (send, signal) => {
@@ -637,7 +789,9 @@ export function createProductionAgentHandler(options) {
             }
             // Resolve custom workspace agent mentions first.
             if (customAgentRefs.length > 0) {
-                const ownerEmail = getRequestUserEmail() || "local@localhost";
+                const ownerEmail = getRequestUserEmail();
+                if (!ownerEmail)
+                    throw new Error("no authenticated user");
                 const { findAccessibleCustomAgent } = await import("../resources/agents.js");
                 const customResults = await Promise.allSettled(customAgentRefs.map(async (ref) => {
                     send({
@@ -686,7 +840,11 @@ export function createProductionAgentHandler(options) {
                         try {
                             const ownerEmail = options.resolveOwnerEmail
                                 ? await options.resolveOwnerEmail(event)
-                                : getRequestUserEmail() || "local@localhost";
+                                : getRequestUserEmail();
+                            if (!ownerEmail) {
+                                // Skip usage recording for unauthenticated runs.
+                                return;
+                            }
                             const { recordUsage } = await import("../usage/store.js");
                             await recordUsage({
                                 ownerEmail,
@@ -828,7 +986,11 @@ export function createProductionAgentHandler(options) {
             let effectiveModel = model;
             try {
                 const { resolveActiveExperimentConfig } = await import("../observability/experiments.js");
-                const expConfig = await resolveActiveExperimentConfig(ownerEmail || "local@localhost");
+                if (!ownerEmail) {
+                    // Without an authenticated owner we can't resolve user-scoped experiments.
+                    throw new Error("no authenticated user");
+                }
+                const expConfig = await resolveActiveExperimentConfig(ownerEmail);
                 if (expConfig) {
                     if (typeof expConfig.configs.model === "string") {
                         effectiveModel = expConfig.configs.model;
@@ -861,7 +1023,7 @@ export function createProductionAgentHandler(options) {
                         loopOpts: agentLoopOpts,
                         runId,
                         threadId: threadId ?? null,
-                        userId: ownerEmail || "local@localhost",
+                        userId: ownerEmail,
                         config: obsConfig,
                     });
                 }
@@ -875,14 +1037,12 @@ export function createProductionAgentHandler(options) {
             if (!instrumented) {
                 loopUsage = await runAgentLoop(agentLoopOpts);
             }
-            // Record token usage for cost monitoring. Always on (not gated by
-            // trackUsage) so the Usage panel in settings works in every mode,
-            // including local dev. `trackUsage` only controls the pre-request
-            // *limit check*; recording happens unconditionally.
+            // Record token usage for cost monitoring so the Usage panel in
+            // settings works in every mode, including local dev.
             try {
                 const ownerEmail = options.resolveOwnerEmail
                     ? await options.resolveOwnerEmail(event)
-                    : getRequestUserEmail() || "local@localhost";
+                    : getRequestUserEmail();
                 if (ownerEmail &&
                     (loopUsage.inputTokens > 0 ||
                         loopUsage.outputTokens > 0 ||