@agent-native/core 0.70.3 → 0.72.0

package/corpus/core/src/deploy/workspace-deploy.ts

@@ -32,6 +32,7 @@ import {
   collectImmutableAssetPaths,
   IMMUTABLE_ASSET_CACHE_HEADERS,
 } from "./immutable-assets.js";
+import { AGENT_CHAT_PROCESS_RUN_PATH } from "../agent/durable-background.js";
 
 export type WorkspaceDeployPreset = "cloudflare_pages" | "netlify" | "vercel";
 
@@ -665,6 +666,126 @@ function copyNetlifyFunctionIntoWorkspace(
   fs.rmSync(dest, { recursive: true, force: true });
   copyDir(src, dest);
   patchNetlifyFunctionEntry(dest, app, workspaceApps, staticDir);
+
+  // Durable background agent runs (off by default). Additive ONLY: when the
+  // flag is off this emits nothing and the single-function deploy is unchanged.
+  if (isDurableBackgroundDeployEnabled()) {
+    emitNetlifyBackgroundFunction(workspaceRoot, app, src, workspaceApps);
+  }
+}
+
+/**
+ * Deploy-time gate for emitting the second `-background` Netlify function. Reads
+ * the same env flag the runtime gate uses (`AGENT_CHAT_DURABLE_BACKGROUND`).
+ * Off by default — when off, the deploy emits exactly one function per app
+ * (today's behavior, byte-for-byte).
+ */
+function isDurableBackgroundDeployEnabled(): boolean {
+  const raw = process.env.AGENT_CHAT_DURABLE_BACKGROUND;
+  if (raw == null) return false;
+  const v = raw.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes" || v === "on";
+}
+
+/**
+ * Emit a SECOND Netlify function for `app` whose name ends in `-background`,
+ * re-exporting the SAME `main.mjs` handler bundle. Netlify invokes any function
+ * whose deployed name ends in `-background` asynchronously (202 immediately, up
+ * to 15-min budget), which is exactly what the durable-background chat
+ * dispatch (`fireInternalDispatch` → AGENT_CHAT_PROCESS_RUN_PATH) needs.
+ *
+ * The function is given a `config.path` of the chat process-run route so
+ * Netlify routes that POST to this async function instead of the synchronous
+ * `<app>-server` function. It shares the same bundle (`includedFiles: ["**"]`)
+ * so `A2A_SECRET`, the DB URL, and the rest of the env/bundle are present.
+ *
+ * ⚠️ REAL-DEPLOY VERIFICATION REQUIRED. The exact Netlify routing/precedence
+ * between this `-background` function's `config.path` and the synchronous
+ * `<app>-server` function's broader `config.path` (which also matches
+ * `/_agent-native/*` for the dispatch app, or `/<app>/*` otherwise) cannot be
+ * verified in this environment. It is emitted additively and only under the
+ * flag; if Netlify resolves the overlap to the wrong function, the dispatch
+ * would land on the synchronous function (no 15-min budget) — the run would
+ * still work via the existing 40s soft-timeout path, just without the durable
+ * win. See packages/core/docs/design/durable-agent-runs.md.
+ */
+function emitNetlifyBackgroundFunction(
+  workspaceRoot: string,
+  app: string,
+  srcServerDir: string,
+  workspaceApps: WorkspaceAppManifestEntry[],
+): void {
+  // Name MUST end in `-background` for Netlify async invocation.
+  const backgroundName = `${app}-agent-background`;
+  const dest = path.join(netlifyFunctionsDir(workspaceRoot), backgroundName);
+  fs.rmSync(dest, { recursive: true, force: true });
+  copyDir(srcServerDir, dest);
+
+  const basePath = `/${app}`;
+  const workspaceAppAudience = workspaceAppAudienceForApp(workspaceApps, app);
+  const workspaceAppRouteAccess = workspaceAppRouteAccessForApp(
+    workspaceApps,
+    app,
+  );
+  // Only the chat process-run route needs the async function. Keeping the path
+  // narrow avoids stealing any other traffic from the synchronous function.
+  // The dispatch URL is app-base-path-prefixed (same as the agent-teams
+  // processor dispatch), so the route Netlify must map to this async function
+  // is `/<app>/_agent-native/agent-chat/_process-run`.
+  const processRunPath = `${basePath}${AGENT_CHAT_PROCESS_RUN_PATH}`;
+  const pathConfig = [processRunPath];
+  const server = `const basePath = ${JSON.stringify(basePath)};
+
+function setBasePathEnv() {
+  const processRef = globalThis.process ??= { env: {} };
+  processRef.env ??= {};
+  Object.assign(processRef.env, {
+    AGENT_NATIVE_WORKSPACE: "1",
+    AGENT_NATIVE_WORKSPACE_APP_ID: ${JSON.stringify(app)},
+    APP_BASE_PATH: basePath,
+    AGENT_NATIVE_WORKSPACE_APP_AUDIENCE: ${JSON.stringify(workspaceAppAudience)},
+    AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS: ${JSON.stringify(JSON.stringify(workspaceAppRouteAccess.publicPaths))},
+    AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS: ${JSON.stringify(JSON.stringify(workspaceAppRouteAccess.protectedPaths))},
+    VITE_AGENT_NATIVE_WORKSPACE: "1",
+    VITE_AGENT_NATIVE_WORKSPACE_APP_ID: ${JSON.stringify(app)},
+    VITE_APP_BASE_PATH: basePath,
+    VITE_AGENT_NATIVE_WORKSPACE_APP_AUDIENCE: ${JSON.stringify(workspaceAppAudience)},
+    VITE_AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS: ${JSON.stringify(JSON.stringify(workspaceAppRouteAccess.publicPaths))},
+    VITE_AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS: ${JSON.stringify(JSON.stringify(workspaceAppRouteAccess.protectedPaths))},
+    VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON: ${JSON.stringify(JSON.stringify(workspaceApps))},
+    ${JSON.stringify(WORKSPACE_APPS_ENV_KEY)}: ${JSON.stringify(JSON.stringify(workspaceApps))},
+  });
+}
+
+setBasePathEnv();
+
+let cachedHandler;
+
+export default async function handler(...args) {
+  setBasePathEnv();
+  cachedHandler ??= (await import("./main.mjs")).default;
+  return cachedHandler(...args);
+}
+
+export const config = {
+  name: ${JSON.stringify(`${app} agent background handler`)},
+  generator: "agent-native workspace deploy",
+  path: ${JSON.stringify(pathConfig)},
+  nodeBundler: "none",
+  includedFiles: ["**"],
+  preferStatic: false,
+};
+`;
+  // Remove the original Nitro entry (server.mjs) so only our background entry
+  // is the function entrypoint, mirroring patchNetlifyFunctionEntry.
+  fs.rmSync(path.join(dest, "server.mjs"), { force: true });
+  fs.writeFileSync(path.join(dest, `${backgroundName}.mjs`), server);
+  console.log(
+    `[workspace-deploy] Emitted durable-background function "${backgroundName}" ` +
+      `for app "${app}" (path ${processRunPath}). ` +
+      `REQUIRES real-deploy verification of Netlify async routing — see ` +
+      `docs/design/durable-agent-runs.md.`,
+  );
 }
 
 function patchNetlifyFunctionEntry(

package/corpus/core/src/mcp/build-server.ts

@@ -952,12 +952,13 @@ async function resolveMcpAppResource(
 ): Promise<ResolvedMcpAppResource | null> {
   const resource = entry.mcpApp?.resource;
   if (!resource) return null;
-  // Inline MCP App embeds are gated behind the deploy-toggleable kill switch
-  // (default off). When disabled, advertise no resource and attach no embed
-  // reference so hosts fall back to the tool's deep-link text instead of an
-  // iframe. This is the single chokepoint for every embed surface: tools/list
-  // descriptor meta, tools/call result meta, resources/list, resources/read.
-  if (!requestMeta?.inlineMcpApps) return null;
+  // NB: the inline kill switch is intentionally NOT enforced here. This
+  // resolver also backs `resources/read`, which must keep serving the shell
+  // for a URI the host already holds (e.g. a cached descriptor) so it degrades
+  // gracefully instead of throwing a hard `-32603`. The switch is enforced at
+  // the *advertisement/render* sites (`tools/list` descriptor meta,
+  // `tools/call` result meta, `resources/list`) so disabled embeds never get
+  // advertised in the first place.
   const resolvedUri = getMcpAppResourceUri(config, actionName, entry);
   if (!resolvedUri) return null;
   const description = resource.description ?? entry.tool.description;
@@ -1006,6 +1007,9 @@ async function getMcpAppResources(
   actions: Record<string, ActionEntry>,
   requestMeta?: MCPRequestMeta,
 ): Promise<ResolvedMcpAppResource[]> {
+  // Advertisement path (resources/list + resources/templates/list): suppressed
+  // by the inline kill switch so disabled embeds are never listed.
+  if (!requestMeta?.inlineMcpApps) return [];
   const resources = await Promise.all(
     Object.entries(actions).map(([name, entry]) =>
       resolveMcpAppResourceSafely(config, name, entry, requestMeta),
@@ -1383,7 +1387,10 @@ export async function createMCPServerForRequest(
               : {};
           const toolMeta = {
             ...rawToolMeta,
-            ...(mcpAppResource
+            // Advertisement path: only tag the tool with its inline-embed
+            // descriptor when the kill switch is on, so disabled embeds never
+            // prompt a host to render/read the `ui://` resource.
+            ...(mcpAppResource && requestMeta?.inlineMcpApps
               ? {
                   ...openAiToolDescriptorMeta(mcpAppResource),
                   [MCP_APP_RESOURCE_URI_META_KEY]: mcpAppResource.uri,
@@ -1524,6 +1531,7 @@ export async function createMCPServerForRequest(
           userEmail: getRequestUserEmail(),
           orgId: getRequestOrgId() ?? null,
           caller: "mcp",
+          actionName: name,
         });
         const mcpResult = isMcpActionResult(result) ? result : null;
         const rawResult = mcpResult ? mcpResult.raw : result;
@@ -1533,12 +1541,14 @@ export async function createMCPServerForRequest(
           !!mcpResult.raw &&
           typeof mcpResult.raw === "object" &&
           (mcpResult.raw as Record<string, unknown>).isError === true;
-        const mcpAppResource = await resolveMcpAppResourceSafely(
-          config,
-          name,
-          entry,
-          requestMeta,
-        );
+        // Render path: only treat the result as an inline embed when the kill
+        // switch is on. When off, `mcpAppResource` is null so every embed
+        // branch below degrades to the plain deep-link artifacts the tool would
+        // otherwise return — no `openai/outputTemplate`, no minted embed-start,
+        // no embed structuredContent — so the host shows a link, not an iframe.
+        const mcpAppResource = requestMeta?.inlineMcpApps
+          ? await resolveMcpAppResourceSafely(config, name, entry, requestMeta)
+          : null;
         const rawResultForClient = mcpAppResource
           ? await withServerMintedMcpAppEmbedStart(rawResult, requestMeta)
           : rawResult;

package/corpus/core/src/oauth-tokens/store.ts

@@ -1,4 +1,5 @@
 import { getDbExec, isPostgres, intType } from "../db/client.js";
+import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 import {
   encryptSecretValue,
   decryptSecretValue,
@@ -81,6 +82,11 @@ async function ensureTable(): Promise<void> {
       await client.execute(
         `UPDATE ${table} SET owner = account_id WHERE owner IS NULL`,
       );
+      // Older deployments have a 32-bit `updated_at`; on Postgres the
+      // `Date.now()` written on every token save overflows int4. Widen in place
+      // (no-op once done / on fresh DBs). Unqualified name — the helper scopes
+      // to the `public` schema.
+      await widenIntColumnsToBigInt("oauth_tokens", ["updated_at"]);
     })().catch((err) => {
       // Retry init on the next call after a failed startup.
       _initPromise = undefined;

package/corpus/core/src/provider-api/custom-registry.ts

@@ -21,6 +21,7 @@
  */
 
 import { getDbExec, isPostgres } from "../db/client.js";
+import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 import { isBlockedExtensionUrlWithDns } from "../extensions/url-safety.js";
 
 // ---------------------------------------------------------------------------
@@ -94,6 +95,13 @@ async function ensureTable(): Promise<void> {
         ? CREATE_SQL.replace(/\bINTEGER\b/g, "BIGINT")
         : CREATE_SQL;
       await client.execute(sql);
+      // Fresh Postgres tables get BIGINT via the replace above, but tables
+      // created before that compat existed kept int4 timestamp columns; widen
+      // them so `Date.now()` writes don't overflow. No-op once done.
+      await widenIntColumnsToBigInt("custom_api_providers", [
+        "created_at",
+        "updated_at",
+      ]);
     })().catch((err) => {
       _initPromise = undefined;
       throw err;

package/corpus/core/src/resources/store.ts

@@ -5,6 +5,7 @@ import {
   retryOnDdlRace,
   type DbExec,
 } from "../db/client.js";
+import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 import { emitResourceChange, emitResourceDelete } from "./emitter.js";
 import type { StoreWriteOptions } from "../settings/store.js";
 import {
@@ -781,6 +782,15 @@ async function _doEnsureTable(): Promise<void> {
   await ensureResourceColumn(client, `expires_at ${intType()}`);
   await ensureResourceColumn(client, "metadata TEXT");
 
+  // Older deployments have 32-bit timestamp columns; on Postgres the
+  // `Date.now()` written on insert/update overflows int4. Widen in place
+  // (no-op once done / on fresh DBs).
+  await widenIntColumnsToBigInt("resources", [
+    "created_at",
+    "updated_at",
+    "expires_at",
+  ]);
+
   // Seed default shared resources if they don't exist (INSERT OR IGNORE to avoid race conditions)
   const now = Date.now();
   const seedSql = isPostgres()

package/corpus/core/src/scripts/runner.ts

@@ -228,11 +228,14 @@ function parsePositionalJsonArg(args: string[]): Record<string, unknown> {
  * resolves `AGENT_USER_EMAIL` / the dev session); we never inject a dev
  * identity here beyond what that wrap already established.
  */
-function cliActionCtx(): import("../action.js").ActionRunContext {
+function cliActionCtx(
+  actionName: string,
+): import("../action.js").ActionRunContext {
   return {
     userEmail: getRequestUserEmail(),
     orgId: getRequestOrgId() ?? null,
     caller: "cli",
+    actionName,
   };
 }
 
@@ -268,7 +271,7 @@ async function dispatchAction(
         typeof handler.run === "function"
       ) {
         const parsed = parseActionArgs(args, { coerceBooleans: true });
-        const result = await handler.run(parsed, cliActionCtx());
+        const result = await handler.run(parsed, cliActionCtx(actionName));
         if (handler.readOnly !== true) {
           await notifyActionChange({ actionName }).catch(() => {});
         }
@@ -298,7 +301,7 @@ async function dispatchAction(
       const parsed = parseActionArgs(args, { coerceBooleans: true });
       const result = await packageAction.run(
         parsed as Record<string, string>,
-        cliActionCtx(),
+        cliActionCtx(actionName),
       );
       if (packageAction.readOnly !== true) {
         await notifyActionChange({ actionName }).catch(() => {});

package/corpus/core/src/server/action-discovery.ts

@@ -580,6 +580,12 @@ export async function mergeCoreSharingActions(
       () => import("../appearance/actions/change-appearance.js"),
     ],
     ["toggle-demo-mode", () => import("../demo/actions/toggle-demo-mode.js")],
+    // Audit log — read surface (who changed what, when, agent vs human).
+    [
+      "list-audit-events",
+      () => import("../audit/actions/list-audit-events.js"),
+    ],
+    ["get-audit-event", () => import("../audit/actions/get-audit-event.js")],
     // Org service tokens (CI credentials, e.g. PLAN_RECAP_TOKEN). Mint/revoke
     // are toolCallable:false — preserved via preserveActionFlags below.
     [

package/corpus/core/src/server/action-routes.ts

@@ -327,6 +327,7 @@ export function mountActionRoutes(
                 userEmail,
                 orgId: orgId ?? null,
                 caller,
+                actionName: name,
               });
 
               // Auto-refresh the UI after a successful mutating action. GET

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -150,6 +150,10 @@ import {
   hasConfiguredA2ASecret,
   isA2AProductionRuntime,
 } from "../a2a/auth-policy.js";
+import {
+  AGENT_CHAT_PROCESS_RUN_PATH,
+  prepareProcessRunRequest,
+} from "../agent/durable-background.js";
 import {
   getBuilderBrowserConnectUrlForOwner,
   resolveBuilderBranchProjectId,
@@ -7695,6 +7699,134 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
         }),
       );
 
+      // Shared per-request invocation: resolve auth/org/timezone context, then
+      // pick the dev/prod/anonymous handler and run it inside the request
+      // context. Used by the main chat POST and by the durable-background
+      // `_process-run` processor route (which re-enters the same handler set as
+      // the background worker), so both go through identical context + handler
+      // selection.
+      const invokeAgentChatHandler = async (event: any) => {
+        // Resolve per-request auth context
+        const ownerContext = await resolveOwnerContext(event);
+        const owner = ownerContext.owner;
+
+        // Resolve org ID: explicit callback > session.orgId from Better Auth
+        // > implicit org membership. Better Auth leaves session.orgId null
+        // until the user explicitly switches orgs, so a fresh signup with
+        // implicit membership (e.g. domain-matched org) would otherwise see
+        // no org-scoped credentials. getOrgContext() does the same DB lookup
+        // the /builder/status endpoint uses to decide "Connected".
+        let resolvedOrgId: string | undefined;
+        if (options?.resolveOrgId) {
+          resolvedOrgId = (await options.resolveOrgId(event)) ?? undefined;
+        } else {
+          try {
+            const session = await getSession(event);
+            resolvedOrgId = session?.orgId ?? undefined;
+          } catch {
+            // Session not available
+          }
+          if (!resolvedOrgId) {
+            try {
+              const { getOrgContext } = await import("../org/context.js");
+              const ctx = await getOrgContext(event);
+              resolvedOrgId = ctx.orgId ?? undefined;
+            } catch {
+              // org_members table may not exist yet on first boot
+            }
+          }
+        }
+
+        // Propagate the caller's IANA timezone from `x-user-timezone` so that
+        // tool calls made by the agent (e.g. log-meal with no explicit date)
+        // resolve "today" in the user's local timezone instead of server UTC.
+        const tzRaw = getHeader(event, "x-user-timezone");
+        const timezone =
+          typeof tzRaw === "string" &&
+          tzRaw.trim().length > 0 &&
+          tzRaw.trim().length < 64
+            ? tzRaw.trim()
+            : undefined;
+
+        return runWithRequestContext(
+          {
+            userEmail: owner,
+            userName: ownerContext.name,
+            orgId: resolvedOrgId,
+            timezone,
+          },
+          () => {
+            // App-rendered chat can't host direct code edits — HMR/full
+            // reloads would kill the same chat surface mid-run. Force the
+            // prod handler (no shell / no fs); the prompt block injected by
+            // `prodHandler.systemPrompt` then steers source changes to a
+            // separate agent surface such as Builder or the dev frame.
+            const blockInProductCodeEditing =
+              shouldBlockInProductCodeEditing(event);
+            const handler =
+              ownerContext.anonymous && anonymousHandler
+                ? anonymousHandler
+                : !blockInProductCodeEditing && currentDevMode && devHandler
+                  ? devHandler
+                  : prodHandler;
+            return handler(event);
+          },
+        );
+      };
+
+      // ─── Durable background agent-chat run processor ──────────────────────
+      // Self-fire target for a long chat turn. The foreground POST claims the
+      // run slot, inserts the run row, and `fireInternalDispatch`es here; this
+      // route runs INSIDE the Netlify background function (15-min budget). It
+      // HMAC-verifies the dispatch (same internal-token scheme as the agent-
+      // teams / A2A / webhook processors), injects the background-run marker,
+      // and re-enters the SAME agent-chat handler as the background worker,
+      // which runs the full multi-step turn inline with the ~13min soft
+      // timeout. With AGENT_CHAT_DURABLE_BACKGROUND off, the foreground never
+      // dispatches here, so this route is never exercised.
+      getH3App(nitroApp).use(
+        AGENT_CHAT_PROCESS_RUN_PATH,
+        defineEventHandler(async (event) => {
+          if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+          }
+          // Consume the body ONCE (h3 v2's web Request stream is single-use).
+          let processBody: any;
+          try {
+            processBody = await readBody(event);
+          } catch {
+            setResponseStatus(event, 400);
+            return { error: "Invalid request body" };
+          }
+
+          // Validate + HMAC-authenticate the self-dispatch and prepare the
+          // background-worker body. Pure decision (unit-tested in
+          // durable-background.spec.ts); the route only wires it to h3.
+          const prepared = prepareProcessRunRequest(
+            processBody,
+            getHeader(event, "authorization"),
+          );
+          if (!prepared.ok) {
+            setResponseStatus(event, prepared.status);
+            return { error: prepared.error };
+          }
+
+          // Stash the verified+augmented body for the handler — the body stream
+          // is already consumed, so the handler reads this instead.
+          (event as any).context = (event as any).context ?? {};
+          (event as any).context.__agentChatBackgroundBody = prepared.body;
+
+          try {
+            return await invokeAgentChatHandler(event);
+          } catch (err: any) {
+            console.error("[agent-chat] _process-run failed:", err);
+            setResponseStatus(event, 500);
+            return { error: "process-run failed" };
+          }
+        }),
+      );
+
       // Mount the main chat handler — delegates to dev or prod handler based on current mode.
       // This is mounted last because h3's use() is prefix-based, meaning /_agent-native/agent-chat
       // also matches /_agent-native/agent-chat/threads/... — we skip sub-path requests here so the
@@ -7713,72 +7845,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             return { error: "Not found" };
           }
 
-          // Resolve per-request auth context
-          const ownerContext = await resolveOwnerContext(event);
-          const owner = ownerContext.owner;
-
-          // Resolve org ID: explicit callback > session.orgId from Better Auth
-          // > implicit org membership. Better Auth leaves session.orgId null
-          // until the user explicitly switches orgs, so a fresh signup with
-          // implicit membership (e.g. domain-matched org) would otherwise see
-          // no org-scoped credentials. getOrgContext() does the same DB lookup
-          // the /builder/status endpoint uses to decide "Connected".
-          let resolvedOrgId: string | undefined;
-          if (options?.resolveOrgId) {
-            resolvedOrgId = (await options.resolveOrgId(event)) ?? undefined;
-          } else {
-            try {
-              const session = await getSession(event);
-              resolvedOrgId = session?.orgId ?? undefined;
-            } catch {
-              // Session not available
-            }
-            if (!resolvedOrgId) {
-              try {
-                const { getOrgContext } = await import("../org/context.js");
-                const ctx = await getOrgContext(event);
-                resolvedOrgId = ctx.orgId ?? undefined;
-              } catch {
-                // org_members table may not exist yet on first boot
-              }
-            }
-          }
-
-          // Propagate the caller's IANA timezone from `x-user-timezone` so that
-          // tool calls made by the agent (e.g. log-meal with no explicit date)
-          // resolve "today" in the user's local timezone instead of server UTC.
-          const tzRaw = getHeader(event, "x-user-timezone");
-          const timezone =
-            typeof tzRaw === "string" &&
-            tzRaw.trim().length > 0 &&
-            tzRaw.trim().length < 64
-              ? tzRaw.trim()
-              : undefined;
-
-          return runWithRequestContext(
-            {
-              userEmail: owner,
-              userName: ownerContext.name,
-              orgId: resolvedOrgId,
-              timezone,
-            },
-            () => {
-              // App-rendered chat can't host direct code edits — HMR/full
-              // reloads would kill the same chat surface mid-run. Force the
-              // prod handler (no shell / no fs); the prompt block injected by
-              // `prodHandler.systemPrompt` then steers source changes to a
-              // separate agent surface such as Builder or the dev frame.
-              const blockInProductCodeEditing =
-                shouldBlockInProductCodeEditing(event);
-              const handler =
-                ownerContext.anonymous && anonymousHandler
-                  ? anonymousHandler
-                  : !blockInProductCodeEditing && currentDevMode && devHandler
-                    ? devHandler
-                    : prodHandler;
-              return handler(event);
-            },
-          );
+          return invokeAgentChatHandler(event);
         }),
       );
 

package/corpus/core/src/server/auth.ts

@@ -70,6 +70,7 @@ import {
   retryOnDdlRace,
   describeDbError,
 } from "../db/client.js";
+import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 import { getBetterAuth, getBetterAuthSync } from "./better-auth-instance.js";
 import type { BetterAuthConfig } from "./better-auth-instance.js";
 import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
@@ -869,6 +870,10 @@ async function ensureSessionTable(): Promise<void> {
       } catch {
         // Column already exists
       }
+      // Older deployments have a 32-bit `created_at`; on Postgres the
+      // `Date.now()` written on session create overflows int4. Widen in place
+      // (no-op once done / on fresh DBs).
+      await widenIntColumnsToBigInt("sessions", ["created_at"]);
     })().catch((err) => {
       // Don't cache the rejection — let the next caller retry a fresh init.
       _sessionInitPromise = undefined;

package/corpus/core/src/server/core-routes-plugin.ts

@@ -757,6 +757,20 @@ export function createCoreRoutesPlugin(
         // Observability module not available — skip
       }
 
+      // Audit log — durable, append-only record of who mutated what app data,
+      // when, and (for the agent) in which run. Capture is automatic at the
+      // action seam; here we just ensure the table exists and start the
+      // retention purge. Best-effort so a missing DB never crashes boot.
+      try {
+        const { ensureAuditTables } = await import("../audit/store.js");
+        const { startAuditCleanupJob } =
+          await import("../audit/cleanup-job.js");
+        ensureAuditTables().catch(() => {});
+        startAuditCleanupJob();
+      } catch {
+        // Audit module not available — skip
+      }
+
       const P = FRAMEWORK_ROUTE_PREFIX;
 
       // Security response headers — emitted on every framework response.

package/corpus/core/src/server/security-headers.ts

@@ -19,11 +19,14 @@
  *   - `Referrer-Policy: strict-origin-when-cross-origin` — strips path/query
  *     from outbound Referer headers when the request crosses origin, so a
  *     public-share viewer's outbound link clicks never leak the share token.
- *   - `Permissions-Policy: camera=(), microphone=(self), geolocation=(),
- *     screen-wake-lock=()` — allows the app shell to request microphone access
- *     for composer dictation while keeping camera/location/wake-lock blocked
- *     by default. Templates that need broader media capture for recording UI
- *     override this on their own routes.
+ *   - `Permissions-Policy: camera=*, microphone=(self), geolocation=(),
+ *     screen-wake-lock=()` — allows microphone access for composer dictation
+ *     and camera access for media-capture UI (the Clips recorder, and the
+ *     Clips browser extension's camera bubble, which is injected as a
+ *     cross-origin iframe and is therefore blocked outright by `camera=()`).
+ *     Location and wake-lock stay disabled. The browser still gates actual
+ *     camera/mic use behind a per-origin permission prompt, so `camera=*` only
+ *     removes the policy-level block, not the user consent.
  *   - `Cross-Origin-Opener-Policy: same-origin` — isolates window.opener so
  *     a popup-window opener reference can't read or modify our document.
  *   - `Cross-Origin-Embedder-Policy: require-corp` — emitted only for
@@ -69,7 +72,7 @@ export function computeInlineScriptHash(scriptContent: string): string {
 
 const HSTS = "max-age=31536000; includeSubDomains; preload";
 const PERMISSIONS_POLICY =
-  "camera=(), microphone=(self), geolocation=(), screen-wake-lock=()";
+  "camera=*, microphone=(self), geolocation=(), screen-wake-lock=()";
 
 /**
  * Returns true when the request was received over HTTPS. We trust both the

package/corpus/core/src/settings/store.ts

@@ -1,5 +1,6 @@
 import { EventEmitter } from "events";
 import { getDbExec, isPostgres, intType } from "../db/client.js";
+import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 
 let _initPromise: Promise<void> | undefined;
 
@@ -25,6 +26,11 @@ async function ensureTable(): Promise<void> {
           updated_at ${intType()} NOT NULL
         )
       `);
+      // Older deployments (pre BIGINT-compat) have a 32-bit `updated_at`; on
+      // Postgres the `Date.now()` written on every setSetting overflows int4.
+      // Widen in place (no-op once done / on fresh DBs). Pass the unqualified
+      // name — the helper scopes to the `public` schema.
+      await widenIntColumnsToBigInt("settings", ["updated_at"]);
       // Index for the poll watermark query: `SELECT MAX(updated_at) FROM settings`.
       // MAX on an indexed column avoids a full-table scan on every poll cycle.
       // IF NOT EXISTS makes it idempotent on existing databases.