@agent-native/core 0.79.16 → 0.79.18

package/corpus/core/src/integrations/plugin.ts

@@ -2,16 +2,18 @@ import { defineEventHandler, setResponseStatus, getMethod, getQuery } from "h3";
 import { getRequestHeader } from "h3";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 
-import { getOrgContext } from "../org/context.js";
+import { getOrgContext, resolveOrgIdForEmail } from "../org/context.js";
 import { loadResourcesForPrompt } from "../server/agent-chat-plugin.js";
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
 import { getSession } from "../server/auth.js";
 import { FRAMEWORK_ROUTE_PREFIX } from "../server/core-routes-plugin.js";
+import { resolveSecret } from "../server/credential-provider.js";
 import {
   getH3App,
   markDefaultPluginProvided,
 } from "../server/framework-request-handler.js";
 import { readBody } from "../server/h3-helpers.js";
+import { runWithRequestContext } from "../server/request-context.js";
 import {
   processA2AContinuationById,
   processDueA2AContinuations,
@@ -175,6 +177,12 @@ type RemoteCodeCommandEnvelope = {
   source?: unknown;
 };
 
+type IntegrationCredentialContext = {
+  userEmail: string;
+  orgId?: string;
+  isIntegrationCaller?: boolean;
+};
+
 const REMOTE_DEVICE_ONLINE_MS = 90_000;
 
 export async function enqueueRemoteCommand(
@@ -517,8 +525,7 @@ export function createIntegrationsPlugin(
     // init can leave us with an empty string forever. The getter
     // re-resolves on every webhook so freshly-set secrets work without
     // a redeploy.
-    const getApiKey = () =>
-      options?.apiKey ?? process.env.ANTHROPIC_API_KEY ?? "";
+    const getApiKey = () => options?.apiKey ?? "";
 
     // Build the system prompt
     const baseSystemPrompt = options?.systemPrompt ?? INTEGRATION_SYSTEM_PROMPT;
@@ -569,6 +576,39 @@ export function createIntegrationsPlugin(
       };
     }
 
+    function toCredentialContext(
+      ctx: { ownerEmail: string; orgId: string | null },
+      opts?: { isIntegrationCaller?: boolean },
+    ): IntegrationCredentialContext {
+      return {
+        userEmail: ctx.ownerEmail,
+        ...(ctx.orgId ? { orgId: ctx.orgId } : {}),
+        ...(opts?.isIntegrationCaller ? { isIntegrationCaller: true } : {}),
+      };
+    }
+
+    async function credentialContextForIntegrationConfig(
+      config: Awaited<ReturnType<typeof getIntegrationConfig>>,
+    ): Promise<IntegrationCredentialContext | null> {
+      const ownerEmail =
+        typeof config?.owner === "string" ? config.owner.trim() : "";
+      if (!ownerEmail) return null;
+      const orgId = await resolveOrgIdForEmail(ownerEmail).catch(() => null);
+      return {
+        userEmail: ownerEmail,
+        ...(orgId ? { orgId } : {}),
+        isIntegrationCaller: true,
+      };
+    }
+
+    async function withCredentialContext<T>(
+      context: IntegrationCredentialContext | null,
+      fn: () => Promise<T>,
+    ): Promise<T> {
+      if (!context) return fn();
+      return runWithRequestContext(context, fn);
+    }
+
     async function requireRemoteDevice(event: any) {
       const token = extractBearerToken(
         getRequestHeader(event, "authorization"),
@@ -627,11 +667,15 @@ export function createIntegrationsPlugin(
           setResponseStatus(event, 405);
           return { error: "Method not allowed" };
         }
-        if (!(await requireSession(event))) return { error: "unauthorized" };
         const baseUrl = getBaseUrl(event);
+        const ctx = await requireSessionContext(event);
+        if (!ctx) return { error: "unauthorized" };
+        const credentialContext = toCredentialContext(ctx);
         const statuses: IntegrationStatus[] = [];
         for (const adapter of adapters) {
-          const status = await adapter.getStatus(baseUrl);
+          const status = await withCredentialContext(credentialContext, () =>
+            adapter.getStatus(baseUrl),
+          );
           const config = await getIntegrationConfig(adapter.platform);
           status.enabled = !!config?.configData?.enabled;
           status.webhookUrl = `${baseUrl}${P}/${adapter.platform}/webhook`;
@@ -1422,9 +1466,13 @@ export function createIntegrationsPlugin(
 
         // ─── GET /:platform/status ─────────────────────────────
         if (action === "status" && method === "GET") {
-          if (!(await requireSession(event))) return { error: "unauthorized" };
+          const ctx = await requireSessionContext(event);
+          if (!ctx) return { error: "unauthorized" };
           const baseUrl = getBaseUrl(event);
-          const status = await adapter.getStatus(baseUrl);
+          const status = await withCredentialContext(
+            toCredentialContext(ctx),
+            () => adapter.getStatus(baseUrl),
+          );
           const config = await getIntegrationConfig(platform);
           status.enabled = !!config?.configData?.enabled;
           status.webhookUrl = `${baseUrl}${P}/${platform}/webhook`;
@@ -1482,14 +1530,20 @@ export function createIntegrationsPlugin(
             return "ok";
           }
 
+          const config = await getIntegrationConfig(platform);
+          const credentialContext =
+            await credentialContextForIntegrationConfig(config);
+
           // Handle platform verification challenges (e.g. Slack url_verification)
           // before checking enable state or parsing the message.
-          const verification = await adapter.handleVerification(event);
+          const verification = await withCredentialContext(
+            credentialContext,
+            () => adapter.handleVerification(event),
+          );
           if (verification.handled) {
             return verification.response ?? "ok";
           }
 
-          const config = await getIntegrationConfig(platform);
           if (!config?.configData?.enabled) {
             setResponseStatus(event, 404);
             return { error: `Integration ${platform} is not enabled` };
@@ -1500,13 +1554,17 @@ export function createIntegrationsPlugin(
           // hangs on streaming providers), and that means handleWebhook's
           // own verifyWebhook step is bypassed. Without this call anyone
           // could POST a forged Slack/Telegram/email payload.
-          const isValid = await adapter.verifyWebhook(event);
+          const isValid = await withCredentialContext(credentialContext, () =>
+            adapter.verifyWebhook(event),
+          );
           if (!isValid) {
             setResponseStatus(event, 401);
             return { error: "Invalid webhook signature" };
           }
 
-          const incoming = await adapter.parseIncomingMessage(event);
+          const incoming = await withCredentialContext(credentialContext, () =>
+            adapter.parseIncomingMessage(event),
+          );
           if (!incoming) {
             setResponseStatus(event, 200);
             return "ok";
@@ -1582,10 +1640,18 @@ export function createIntegrationsPlugin(
           if (platform === "telegram") {
             const baseUrl = getBaseUrl(event);
             const webhookUrl = `${baseUrl}${P}/telegram/webhook`;
-            const token = process.env.TELEGRAM_BOT_TOKEN;
+            const ctx = await requireSessionContext(event);
+            if (!ctx) return { error: "unauthorized" };
+            const token = await withCredentialContext(
+              toCredentialContext(ctx),
+              () => resolveSecret("TELEGRAM_BOT_TOKEN"),
+            );
             if (!token) {
               setResponseStatus(event, 400);
-              return { error: "TELEGRAM_BOT_TOKEN not configured" };
+              return {
+                error:
+                  "TELEGRAM_BOT_TOKEN not configured. Save it in settings.",
+              };
             }
             try {
               const res = await fetch(

package/corpus/core/src/onboarding/default-steps.ts

@@ -17,6 +17,7 @@ import {
 import {
   canUseDeployCredentialFallbackForRequest,
   readDeployCredentialEnv,
+  resolveSecret,
 } from "../server/credential-provider.js";
 import { getSetting } from "../settings/store.js";
 import { registerOnboardingStep } from "./registry.js";
@@ -287,12 +288,14 @@ const emailStep: OnboardingStep = {
       },
     },
   ],
-  isComplete: () => {
-    if (process.env.RESEND_API_KEY) return true;
+  isComplete: async () => {
+    if (await resolveSecret("RESEND_API_KEY")) return true;
     // SendGrid rejects Resend's sandbox sender, so EMAIL_FROM must also be
     // set — otherwise sendEmail() throws at runtime even though the API key
     // is configured.
-    if (process.env.SENDGRID_API_KEY) return !!process.env.EMAIL_FROM;
+    if (await resolveSecret("SENDGRID_API_KEY")) {
+      return !!(await resolveSecret("EMAIL_FROM"));
+    }
     return false;
   },
 };

package/corpus/core/src/onboarding/types.ts

@@ -9,7 +9,7 @@
 
 export type OnboardingMethodBadge = "recommended" | "beta" | "free" | "soon";
 
-/** Fields for a form-style onboarding method (key/value env-var entry). */
+/** Fields for a form-style onboarding method (key/value secret entry). */
 export interface OnboardingFormField {
   key: string;
   label: string;

package/corpus/core/src/org/handlers.ts

@@ -312,7 +312,7 @@ async function inviteOne(
 
   let emailSent = false;
   let emailError: string | undefined;
-  if (isEmailConfigured()) {
+  if (await isEmailConfigured()) {
     try {
       const { subject, html, text } = renderInviteEmail({
         invitee: email,

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -5435,10 +5435,7 @@ export function createAgentChatPlugin(
               // Sub-agents must inherit the parent run's resolved key so
               // delegations spawned by agent-teams don't silently fall back
               // to the platform key while the parent uses BYO credentials.
-              apiKey:
-                runCtx?.userApiKey ??
-                options?.apiKey ??
-                process.env.ANTHROPIC_API_KEY,
+              apiKey: runCtx?.userApiKey ?? options?.apiKey,
             })
           );
         },
@@ -6949,7 +6946,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
           const { getOwnerActiveApiKey } =
             await import("../agent/production-agent.js");
           const userApiKey = await getOwnerActiveApiKey(ownerEmail);
-          const apiKey = userApiKey ?? process.env.ANTHROPIC_API_KEY;
+          const apiKey = userApiKey;
           if (!apiKey) {
             // Fallback: truncate the message
             return { title: cleanMessage.trim().slice(0, 60) };
@@ -7985,7 +7982,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
               : await buildSchemaBlock(owner, databaseToolsMode);
             return basePrompt + resources + schemaBlock;
           },
-          apiKey: options?.apiKey ?? process.env.ANTHROPIC_API_KEY,
+          apiKey: options?.apiKey,
           model: options?.model,
           appId: options?.appId,
         };
@@ -8084,7 +8081,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
               : await buildSchemaBlock(owner, databaseToolsMode);
             return basePrompt + resources + schemaBlock;
           },
-          apiKey: options?.apiKey ?? process.env.ANTHROPIC_API_KEY,
+          apiKey: options?.apiKey,
           model: options?.model,
           appId: options?.appId,
         });

package/corpus/core/src/server/better-auth-instance.ts

@@ -125,6 +125,8 @@ export async function trackSignupEvent({
 // Persistent auth secret
 // ---------------------------------------------------------------------------
 
+let inMemoryDevAuthSecret: string | undefined;
+
 /**
  * Resolve the Better Auth signing secret.
  *
@@ -133,13 +135,9 @@ export async function trackSignupEvent({
  *   2. Hosted workspace deploys can derive a per-purpose secret from the
  *      already-required `A2A_SECRET` root. This keeps fresh workspace branches
  *      bootable without reusing the raw A2A key as a cookie-signing key.
- *   3. `.env.local` in the template cwd — a per-workspace persistent secret
- *      that the framework writes once on first boot when no secret is set.
- *      Gitignored by convention (`.env*` in template .gitignore files), so
- *      it's safe to persist credentials here.
- *   4. Generate a new random 32-byte hex, write it to `.env.local`, and use
- *      it. Subsequent restarts re-read the same file — so session cookies
- *      signed by a previous boot remain valid across dev-server restarts.
+ *   3. Existing `.env.local` values in the template cwd — read-only
+ *      compatibility for projects that already configured this secret.
+ *   4. Generate a per-process in-memory random 32-byte hex in development.
  *
  * Why this matters: before this helper existed, missing `BETTER_AUTH_SECRET`
  * fell through to `GOOGLE_CLIENT_SECRET` / `ACCESS_TOKEN` / a hardcoded
@@ -147,8 +145,8 @@ export async function trackSignupEvent({
  * boot would re-fall back to the hardcoded value (still stable) — but
  * rotating Google credentials, toggling `ACCESS_TOKEN`, or churning the
  * fallback chain would invalidate every signed cookie and force everyone
- * to sign in again. Pinning the secret to `.env.local` on first boot
- * removes that footgun.
+ * to sign in again. We still read explicit env configuration, but never
+ * auto-write a generated secret into env files.
  */
 function resolveAuthSecret(): string {
   if (process.env.BETTER_AUTH_SECRET) return process.env.BETTER_AUTH_SECRET;
@@ -177,47 +175,26 @@ function resolveAuthSecret(): string {
     );
   }
 
-  // Dev: persist a generated secret to .env.local so sessions survive
-  // dev-server restarts. Falls back to an in-memory random secret only if
-  // the filesystem isn't writable (rare in dev, e.g. read-only mounts) —
-  // sessions reset on every dev-process restart in that case, which is
-  // fine.
-  //
   // SECURITY (audit 09 LOW-2): the previous fallback chain
   // (`GOOGLE_CLIENT_SECRET || ACCESS_TOKEN || hardcoded`) reused
   // cross-purpose secrets and a public hardcoded literal as the cookie
   // HMAC. Dropped entirely — better to mint an ephemeral secret than to
   // re-use a Google client secret or a known string.
-  try {
-    const envLocalPath = path.resolve(process.cwd(), ".env.local");
-    const existing = readEnvLocalSecret(envLocalPath);
-    if (existing) {
-      process.env.BETTER_AUTH_SECRET = existing; // guard:allow-env-mutation — boot-time secret resolution from .env.local, runs once at module init
-      return existing;
-    }
+  const existing = readEnvLocalSecret(
+    path.resolve(process.cwd(), ".env.local"),
+  );
+  if (existing) return existing;
 
-    const generated = crypto.randomBytes(32).toString("hex");
-    appendEnvLocalSecret(envLocalPath, generated);
-    process.env.BETTER_AUTH_SECRET = generated; // guard:allow-env-mutation — boot-time secret generation, runs once at module init before any request
-    console.log(
-      "[agent-native] Generated a persistent BETTER_AUTH_SECRET in .env.local. " +
-        "Sessions will now survive dev-server restarts. " +
-        "(Delete .env.local to rotate; set BETTER_AUTH_SECRET in .env to override.)",
-    );
-    return generated;
-  } catch {
-    // Filesystem unwritable (read-only mount, sandboxed test env, etc.).
-    // Mint a per-process random secret so cookies stay unique per boot.
-    // Sessions reset when the dev process restarts — acceptable for dev.
-    const ephemeral = crypto.randomBytes(32).toString("hex");
+  if (!inMemoryDevAuthSecret) {
+    inMemoryDevAuthSecret = crypto.randomBytes(32).toString("hex");
     console.warn(
-      "[agent-native] Could not persist BETTER_AUTH_SECRET to .env.local " +
-        "(filesystem unwritable). Using an ephemeral in-memory secret. " +
-        "Sessions will reset every time this process restarts. " +
-        "Set BETTER_AUTH_SECRET in your environment to keep sessions valid across restarts.",
+      "[agent-native] BETTER_AUTH_SECRET is not configured. Using an ephemeral " +
+        "in-memory development secret. Sessions will reset every time this " +
+        "process restarts. Set BETTER_AUTH_SECRET in your environment to keep " +
+        "sessions valid across restarts.",
     );
-    return ephemeral;
   }
+  return inMemoryDevAuthSecret;
 }
 
 function readEnvLocalSecret(envLocalPath: string): string | undefined {
@@ -234,26 +211,6 @@ function readEnvLocalSecret(envLocalPath: string): string | undefined {
   }
 }
 
-function appendEnvLocalSecret(envLocalPath: string, secret: string): void {
-  const header =
-    "# Auto-generated by agent-native on first boot. Gitignored.\n" +
-    "# Keeps signed session cookies valid across dev-server restarts.\n" +
-    "# Delete this file (or this line) to rotate the secret.\n";
-  const line = `BETTER_AUTH_SECRET=${secret}\n`;
-
-  // If the file already exists, just append; otherwise create with header.
-  if (fs.existsSync(envLocalPath)) {
-    const existing = fs.readFileSync(envLocalPath, "utf8");
-    const needsLeadingNewline = existing.length > 0 && !existing.endsWith("\n");
-    fs.appendFileSync(
-      envLocalPath,
-      (needsLeadingNewline ? "\n" : "") + "\n" + header + line,
-    );
-  } else {
-    fs.writeFileSync(envLocalPath, header + line, { mode: 0o600 });
-  }
-}
-
 function normalizeTrackingSlug(value: string | undefined): string | undefined {
   const trimmed = value?.trim();
   if (!trimmed) return undefined;
@@ -912,7 +869,7 @@ async function createBetterAuthInstance(
   const appUrl = getAppProductionUrl();
   const cookieNamespace = resolveAuthCookieNamespace();
   const requireEmailVerification =
-    isEmailConfigured() && !shouldSkipEmailVerification();
+    (await isEmailConfigured()) && !shouldSkipEmailVerification();
 
   const shouldMirrorGoogleAccountTokens =
     (config?.googleScopes?.length ?? 0) > 0;