@agent-native/core 0.79.16 → 0.79.18

package/corpus/core/src/server/core-routes-plugin.ts

@@ -1,5 +1,3 @@
-import path from "node:path";
-
 import {
   defineEventHandler,
   setResponseStatus,
@@ -46,7 +44,7 @@ import { mountDbAdminRoutes } from "../db-admin/routes.js";
 import { getDbExec } from "../db/client.js";
 import {
   uploadFile,
-  getActiveFileUploadProvider,
+  getActiveFileUploadProviderForRequest,
   listFileUploadProviders,
 } from "../file-upload/index.js";
 import { handleMcpConnect } from "../mcp/connect-route.js";
@@ -57,10 +55,8 @@ import {
 } from "../mcp/oauth-route.js";
 import { registerBuiltinNotificationChannels } from "../notifications/channels.js";
 import { createNotificationsHandler } from "../notifications/routes.js";
-import { listOnboardingSteps } from "../onboarding/registry.js";
 import { getOrgContext } from "../org/context.js";
 import { createProgressHandler } from "../progress/routes.js";
-import { findWorkspaceRoot } from "../scripts/utils.js";
 import { registerFrameworkSecrets } from "../secrets/register-framework-secrets.js";
 import {
   createListSecretsHandler,
@@ -124,14 +120,12 @@ import {
   getAllowedCorsOrigin,
   readCorsAllowedOrigins,
 } from "./cors-origins.js";
-import { upsertEnvFile } from "./create-server.js";
 import type { EnvKeyConfig } from "./create-server.js";
 import {
   canUseDeployCredentialFallbackForRequest,
   resolveSecret,
 } from "./credential-provider.js";
 import { createEmbedStartRouteHandler } from "./embed-route.js";
-import { isEnvVarWriteAllowed } from "./env-var-writes.js";
 import {
   getH3App,
   awaitBootstrap,
@@ -151,6 +145,12 @@ import { createOpenRouteHandler } from "./open-route.js";
 import { createPollEventsHandler } from "./poll-events.js";
 import { createPollHandler } from "./poll.js";
 import { runWithRequestContext } from "./request-context.js";
+import {
+  findUnsupportedScopedKeyNames,
+  saveKeyValuesToScopedSecrets,
+  ScopedKeyStorageError,
+  type ScopedKeySaveRequestScope,
+} from "./scoped-key-storage.js";
 import { createTranscribeVoiceHandler } from "./transcribe-voice.js";
 import { createVoiceProvidersStatusHandler } from "./voice-providers-status.js";
 
@@ -340,10 +340,6 @@ function parseBuilderCallbackBoolean(
   return /^(1|true)$/i.test(value);
 }
 
-const PROVIDER_ENV_VAR_KEYS = new Set(
-  Object.values(PROVIDER_ENV_META).map(({ envVar }) => envVar),
-);
-
 // Raster-only data-URI allowlist for avatar writes. SVG is deliberately absent:
 // data:image/svg+xml payloads can carry inline <script> and event-handler
 // attributes that execute when the browser renders them as an <img> src or
@@ -652,7 +648,7 @@ export interface CoreRoutesPluginOptions {
  *   GET    /_agent-native/ping                          — health check
  *   GET    /_agent-native/health                        — DB liveness probe + scale-to-zero warmup
  *   GET    /_agent-native/env-status                    — env key configuration status (when envKeys provided)
- *   POST   /_agent-native/env-vars                      — save env vars to .env (when envKeys provided)
+ *   POST   /_agent-native/env-vars                      — compatibility route that saves keys to scoped DB secrets
  *   GET    /_agent-native/application-state/:key        — read application state
  *   PUT    /_agent-native/application-state/:key        — write application state
  *   DELETE /_agent-native/application-state/:key        — delete application state
@@ -681,20 +677,9 @@ export function createCoreRoutesPlugin(
     try {
       await awaitBootstrap(nitroApp);
 
-      // Restore env vars from the settings table. On serverless, .env
-      // writes don't persist across invocations — the DB is the durable
-      // store. Only set keys that are currently empty so explicit env
-      // vars (Netlify dashboard, process-level) always win.
-      //
-      // GATED: only rehydrate into `process.env` on local-dev SQLite (or
-      // with the explicit single-tenant opt-in). On a shared-DB hosted
-      // multi-tenant deploy the `persisted-env-vars` row is deployment-wide
-      // global state — pushing user-supplied values into `process.env` from
-      // it would let any one tenant's writes (or a stale dev seed) leak
-      // into every other tenant's process. The opt-out scrub of legacy
-      // BUILDER_* values still runs unconditionally so existing rows on
-      // multi-tenant deploys self-heal, but new env-var writes never land
-      // in `process.env` outside the allowed contexts.
+      // Legacy cleanup: key saves now go to scoped app_secrets rows. Do not
+      // rehydrate the old deployment-global `persisted-env-vars` row into
+      // process.env; keep only the Builder scrub so stale leaked keys self-heal.
       try {
         const persisted = (await getSetting("persisted-env-vars")) as Record<
           string,
@@ -702,15 +687,10 @@ export function createCoreRoutesPlugin(
         > | null;
         if (persisted) {
           const builderKeys = new Set<string>(BUILDER_ENV_KEYS);
-          const writesAllowed = isEnvVarWriteAllowed();
           let scrubbed = 0;
-          for (const [k, v] of Object.entries(persisted)) {
+          for (const k of Object.keys(persisted)) {
             if (builderKeys.has(k)) {
               scrubbed++;
-              continue;
-            }
-            if (writesAllowed && typeof v === "string" && !process.env[k]) {
-              process.env[k] = v;
             }
           }
           if (scrubbed > 0) {
@@ -2229,24 +2209,7 @@ export function createCoreRoutesPlugin(
       ];
       {
         const envKeys = [...frameworkEnvKeys, ...(options.envKeys ?? [])];
-
-        // Onboarding form fields are resolved per-request so late-registered
-        // steps (and template overrides) are picked up without a restart.
-        // Builder CLI auth writes scoped Builder credentials through the
-        // credential provider, never through the deploy-global env sink.
-        const collectOnboardingKeys = (): Set<string> => {
-          const keys = new Set<string>();
-          for (const step of listOnboardingSteps()) {
-            for (const method of step.methods) {
-              if (method.kind === "form") {
-                for (const field of method.payload.fields) {
-                  if (field?.key) keys.add(field.key);
-                }
-              }
-            }
-          }
-          return keys;
-        };
+        const allowedEnvKeyNames = envKeys.map(({ key }) => key);
 
         getH3App(nitroApp).use(
           `${P}/env-status`,
@@ -2264,12 +2227,11 @@ export function createCoreRoutesPlugin(
             }
             return Promise.all(
               envKeys.map(async (cfg) => {
-                const isProviderKey = PROVIDER_ENV_VAR_KEYS.has(cfg.key);
-                const configured = isProviderKey
-                  ? await runWithRequestContext({ userEmail, orgId }, () =>
-                      resolveSecret(cfg.key).then(Boolean),
-                    )
-                  : !!process.env[cfg.key];
+                const configured =
+                  Boolean(process.env[cfg.key]) ||
+                  (await runWithRequestContext({ userEmail, orgId }, () =>
+                    resolveSecret(cfg.key).then(Boolean),
+                  ));
                 return {
                   key: cfg.key,
                   label: cfg.label,
@@ -2290,101 +2252,37 @@ export function createCoreRoutesPlugin(
               return { error: "Method not allowed" };
             }
 
-            // Env vars are deployment-wide globals, not per-tenant. On any
-            // shared-DB multi-tenant deploy, allowing authenticated users to
-            // write here lets one tenant overwrite Stripe / OpenAI / Sentry
-            // keys for every other tenant. Disable the endpoint outside of
-            // local-dev SQLite or an explicit single-tenant opt-in, and
-            // direct callers to scoped secret/credential stores instead.
-            if (!isEnvVarWriteAllowed()) {
-              setResponseStatus(event, 403);
-              return {
-                error:
-                  "env-vars endpoint disabled on multi-tenant deployments. Use scoped secrets or credentials for user/org API keys.",
-              };
-            }
-
             const body = await readBody(event);
-            const { vars } = body as {
+            const { vars, scope } = body as {
               vars?: Array<{ key: string; value: string }>;
+              scope?: ScopedKeySaveRequestScope;
             };
-
-            if (!Array.isArray(vars) || vars.length === 0) {
-              setResponseStatus(event, 400);
-              return { error: "vars array required" };
-            }
-
-            const allowedKeys = new Set<string>([
-              ...envKeys.map((k) => k.key),
-              ...collectOnboardingKeys(),
-            ]);
-            const blockedEnvVarWriteKeys = new Set<string>(BUILDER_ENV_KEYS);
-            const isWritableEnvKey = (key: string) =>
-              allowedKeys.has(key) && !blockedEnvVarWriteKeys.has(key);
-
-            const filtered = vars.filter(
-              (v) =>
-                typeof v.key === "string" &&
-                isWritableEnvKey(v.key) &&
-                typeof v.value === "string" &&
-                v.value.trim().length > 0,
+            const unsupportedKeys = findUnsupportedScopedKeyNames(
+              vars,
+              allowedEnvKeyNames,
             );
-            if (filtered.length === 0) {
+            if (unsupportedKeys.length > 0) {
               setResponseStatus(event, 400);
-              const rejectedEmpty = vars.some(
-                (v) =>
-                  typeof v.key === "string" &&
-                  isWritableEnvKey(v.key) &&
-                  (typeof v.value !== "string" || v.value.trim().length === 0),
-              );
               return {
-                error: rejectedEmpty
-                  ? "Env values must be non-empty — refusing to clear a saved key"
-                  : "No recognized env keys in request",
+                error: `Unsupported env key${unsupportedKeys.length === 1 ? "" : "s"}: ${unsupportedKeys.join(", ")}`,
               };
             }
 
-            // Write to .env file. When inside a workspace, write to the
-            // workspace root .env so keys are shared across every app. The
-            // per-app .env still wins at load time if it also defines a key.
             try {
-              const scope =
-                (body as { scope?: "workspace" | "app" })?.scope ?? "auto";
-              const workspaceRoot = findWorkspaceRoot(process.cwd());
-              const envPath =
-                scope === "app"
-                  ? path.join(process.cwd(), ".env")
-                  : workspaceRoot
-                    ? path.join(workspaceRoot, ".env")
-                    : path.join(process.cwd(), ".env");
-              await upsertEnvFile(envPath, filtered);
-            } catch {
-              // Edge runtime — skip file write
-            }
-
-            // Update process.env immediately
-            for (const { key, value } of filtered) {
-              process.env[key] = value;
-            }
-
-            // Persist to settings table for serverless cold-start recovery.
-            try {
-              const envMap: Record<string, string> = {};
-              for (const { key, value } of filtered) envMap[key] = value;
-              const existing =
-                ((await getSetting("persisted-env-vars")) as Record<
-                  string,
-                  string
-                > | null) ?? {};
-              await putSetting("persisted-env-vars", {
-                ...existing,
-                ...envMap,
-              });
-            } catch {
-              // DB not ready yet — skip
+              const result = await saveKeyValuesToScopedSecrets(
+                event,
+                vars,
+                scope,
+              );
+              return { saved: result.saved, storage: "scoped-secrets" };
+            } catch (err) {
+              if (err instanceof ScopedKeyStorageError) {
+                setResponseStatus(event, err.statusCode);
+                return { error: err.message };
+              }
+              setResponseStatus(event, 500);
+              return { error: "Failed to save keys" };
             }
-
-            return { saved: filtered.map((v) => v.key) };
           }),
         );
       }
@@ -2729,54 +2627,69 @@ export function createCoreRoutesPlugin(
       getH3App(nitroApp).use(
         `${P}/file-upload/status`,
         defineEventHandler(async (event) => {
-          const active = getActiveFileUploadProvider();
           // resolveBuilderPrivateKey() reads per-user credentials from app_secrets
           // (DB), which requires request context (AsyncLocalStorage) to know which
           // user to scope by. Without runWithRequestContext() the ALS store is empty
           // and it falls back to process.env only — missing OAuth-connected users.
           const session = await getSession(event).catch(() => null);
           const userEmail = session?.email;
-          let builderConfigured = !!process.env.BUILDER_PRIVATE_KEY;
-          try {
-            const { resolveBuilderPrivateKey } =
-              await import("./credential-provider.js");
-            const resolve = () => resolveBuilderPrivateKey().then((k) => !!k);
-            builderConfigured = userEmail
-              ? await runWithRequestContext(
-                  { userEmail, orgId: session?.orgId },
-                  resolve,
-                )
-              : await resolve();
-          } catch {
-            // fall back to env check above
-          }
-          // When the builder builtin is selected via env var, its sync
-          // isConfigured() doesn't reflect per-user OAuth credentials. Use the
-          // async builderConfigured check so the status accurately represents
-          // whether this specific user can actually upload (thread 7 fix).
-          const isBuilderEnvActive = active?.id === "builder";
-          const configured = isBuilderEnvActive
-            ? builderConfigured
-            : !!active || builderConfigured;
-          const activeProvider = isBuilderEnvActive
-            ? builderConfigured
-              ? { id: "builder", name: "Builder.io" }
-              : null
-            : active
-              ? { id: active.id, name: active.name }
-              : builderConfigured
+          const resolveStatus = async () => {
+            const active = await getActiveFileUploadProviderForRequest();
+            let builderConfigured = !!process.env.BUILDER_PRIVATE_KEY;
+            try {
+              const { resolveBuilderPrivateKey } =
+                await import("./credential-provider.js");
+              builderConfigured = await resolveBuilderPrivateKey().then(
+                (k) => !!k,
+              );
+            } catch {
+              // fall back to env check above
+            }
+
+            const providers = await Promise.all(
+              listFileUploadProviders().map(async (p) => {
+                const scopedConfigured = p.isConfiguredForRequest
+                  ? await p.isConfiguredForRequest().catch(() => false)
+                  : false;
+                return {
+                  id: p.id,
+                  name: p.name,
+                  configured: p.isConfigured() || scopedConfigured,
+                };
+              }),
+            );
+
+            // When the builder builtin is selected via env var, its sync
+            // isConfigured() doesn't reflect per-user OAuth credentials. Use
+            // builderConfigured so status reflects this specific request.
+            const isBuilderEnvActive = active?.id === "builder";
+            const configured = isBuilderEnvActive
+              ? builderConfigured
+              : !!active || builderConfigured;
+            const activeProvider = isBuilderEnvActive
+              ? builderConfigured
                 ? { id: "builder", name: "Builder.io" }
-                : null;
-          return {
-            configured,
-            activeProvider,
-            providers: listFileUploadProviders().map((p) => ({
-              id: p.id,
-              name: p.name,
-              configured: p.isConfigured(),
-            })),
-            builderConfigured,
+                : null
+              : active
+                ? { id: active.id, name: active.name }
+                : builderConfigured
+                  ? { id: "builder", name: "Builder.io" }
+                  : null;
+
+            return {
+              configured,
+              activeProvider,
+              providers,
+              builderConfigured,
+            };
           };
+
+          return userEmail
+            ? runWithRequestContext(
+                { userEmail, orgId: session?.orgId },
+                resolveStatus,
+              )
+            : resolveStatus();
         }),
       );
 

package/corpus/core/src/server/create-server.ts

@@ -1,5 +1,3 @@
-import path from "path";
-
 import {
   createApp,
   createRouter,
@@ -11,8 +9,8 @@ import {
   type H3Event,
 } from "h3";
 
+import { getOrgContext } from "../org/context.js";
 import { readBody } from "../server/h3-helpers.js";
-import { agentEnv } from "../shared/agent-env.js";
 import { EMBED_TARGET_HEADER } from "../shared/embed-auth.js";
 import {
   EMBED_TRANSPLANT_HEADER,
@@ -20,12 +18,19 @@ import {
   MCP_EMBED_CORS_ALLOW_HEADERS,
   shouldAllowMcpEmbedCredentials,
 } from "../shared/mcp-embed-headers.js";
-import { BUILDER_ENV_KEYS } from "./builder-browser.js";
+import { getSession } from "./auth.js";
 import {
   getAllowedCorsOrigin,
   readCorsAllowedOrigins,
 } from "./cors-origins.js";
-import { isEnvVarWriteAllowed } from "./env-var-writes.js";
+import { resolveSecret } from "./credential-provider.js";
+import { runWithRequestContext } from "./request-context.js";
+import {
+  findUnsupportedScopedKeyNames,
+  saveKeyValuesToScopedSecrets,
+  ScopedKeyStorageError,
+  type ScopedKeySaveRequestScope,
+} from "./scoped-key-storage.js";
 
 export interface EnvKeyConfig {
   /** Environment variable name (e.g. "HUBSPOT_ACCESS_TOKEN") */
@@ -47,70 +52,10 @@ export interface CreateServerOptions {
   pingMessage?: string;
   /** Disable the /_agent-native/ping health check. Default: false */
   disablePing?: boolean;
-  /** Env key configuration for the settings UI. Enables /_agent-native/env-status and /_agent-native/env-vars routes. */
+  /** Key configuration for the settings UI. Enables status plus the scoped-secret compatibility save route. */
   envKeys?: EnvKeyConfig[];
 }
 
-/**
- * Upsert vars into a .env file, preserving existing structure.
- */
-export async function upsertEnvFile(
-  envPath: string,
-  vars: Array<{ key: string; value: string }>,
-): Promise<void> {
-  // Sanitize: reject values that could inject additional env vars
-  for (const { key, value } of vars) {
-    if (/[\n\r\0]/.test(value)) {
-      throw new Error(
-        `Invalid env var value for ${key}: must not contain newlines or control characters`,
-      );
-    }
-  }
-
-  const fs = await import("fs");
-
-  let content = "";
-  try {
-    content = fs.readFileSync(envPath, "utf-8");
-  } catch {
-    // File doesn't exist yet
-  }
-
-  const lines = content.split("\n");
-  const remaining = new Map(vars.map((v) => [v.key, v.value]));
-
-  // Update existing lines in place
-  const updated = lines.map((line) => {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) return line;
-    const eqIndex = trimmed.indexOf("=");
-    if (eqIndex === -1) return line;
-    const key = trimmed.slice(0, eqIndex).trim();
-    if (remaining.has(key)) {
-      const value = remaining.get(key)!;
-      remaining.delete(key);
-      return `${key}=${value}`;
-    }
-    return line;
-  });
-
-  // Append new vars
-  for (const [key, value] of remaining) {
-    updated.push(`${key}=${value}`);
-  }
-
-  // Ensure trailing newline
-  let result = updated.join("\n");
-  if (!result.endsWith("\n")) result += "\n";
-
-  try {
-    fs.mkdirSync(path.dirname(envPath), { recursive: true });
-    fs.writeFileSync(envPath, result);
-  } catch {
-    // Edge runtimes don't have writable filesystem — skip silently
-  }
-}
-
 export interface CreateServerResult {
   app: ReturnType<typeof createApp>;
   router: ReturnType<typeof createRouter>;
@@ -120,7 +65,8 @@ export interface CreateServerResult {
  * Create a pre-configured H3 app with standard agent-native setup:
  * - CORS headers via middleware
  * - /_agent-native/ping health check
- * - /_agent-native/env-status and /_agent-native/env-vars (when envKeys is provided)
+ * - /_agent-native/env-status and the scoped-secret compatibility save route
+ *   at /_agent-native/env-vars (when envKeys is provided)
  *
  * Returns { app, router } — mount routes on `router`.
  */
@@ -242,7 +188,6 @@ export function createServer(
   }
 
   const router = createRouter();
-  app.use(router);
 
   // Health check
   if (!options.disablePing) {
@@ -259,73 +204,67 @@ export function createServer(
   // Env key management routes
   if (options.envKeys) {
     const envKeys = options.envKeys;
+    const allowedEnvKeyNames = envKeys.map(({ key }) => key);
 
     router.get(
       "/_agent-native/env-status",
-      defineEventHandler(() => {
-        return envKeys.map((cfg) => ({
-          key: cfg.key,
-          label: cfg.label,
-          required: cfg.required ?? false,
-          configured: !!process.env[cfg.key],
-          ...(cfg.helpText ? { helpText: cfg.helpText } : {}),
-        }));
+      defineEventHandler(async (event) => {
+        const session = await getSession(event).catch(() => null);
+        const userEmail = session?.email;
+        let orgId: string | undefined;
+        if (userEmail) {
+          const orgCtx = await getOrgContext(event).catch(() => null);
+          orgId = orgCtx?.orgId ?? undefined;
+        }
+        return Promise.all(
+          envKeys.map(async (cfg) => ({
+            key: cfg.key,
+            label: cfg.label,
+            required: cfg.required ?? false,
+            configured:
+              Boolean(process.env[cfg.key]) ||
+              (await runWithRequestContext({ userEmail, orgId }, () =>
+                resolveSecret(cfg.key).then(Boolean),
+              )),
+            ...(cfg.helpText ? { helpText: cfg.helpText } : {}),
+          })),
+        );
       }),
     );
 
     router.post(
       "/_agent-native/env-vars",
       defineEventHandler(async (event: H3Event) => {
-        // Env vars are deployment-wide globals — see isEnvVarWriteAllowed
-        // above. Disable the endpoint on any multi-tenant deploy.
-        if (!isEnvVarWriteAllowed()) {
-          setResponseStatus(event, 403);
-          return {
-            error:
-              "env-vars endpoint disabled on multi-tenant deployments. Use scoped secrets or credentials for user/org API keys.",
-          };
-        }
-
         const body = await readBody(event);
-        const { vars } = body as {
+        const { vars, scope } = body as {
           vars?: Array<{ key: string; value: string }>;
+          scope?: ScopedKeySaveRequestScope;
         };
-
-        if (!Array.isArray(vars) || vars.length === 0) {
-          setResponseStatus(event, 400);
-          return { error: "vars array required" };
-        }
-
-        // Only allow keys that are in the env config
-        const allowedKeys = new Set(envKeys.map((k) => k.key));
-        const blockedEnvVarWriteKeys = new Set<string>(BUILDER_ENV_KEYS);
-        const filtered = vars.filter(
-          (v) =>
-            typeof v.key === "string" &&
-            allowedKeys.has(v.key) &&
-            !blockedEnvVarWriteKeys.has(v.key),
+        const unsupportedKeys = findUnsupportedScopedKeyNames(
+          vars,
+          allowedEnvKeyNames,
         );
-        if (filtered.length === 0) {
+        if (unsupportedKeys.length > 0) {
           setResponseStatus(event, 400);
-          return { error: "No recognized env keys in request" };
+          return {
+            error: `Unsupported env key${unsupportedKeys.length === 1 ? "" : "s"}: ${unsupportedKeys.join(", ")}`,
+          };
         }
-
-        // Write to .env file
-        const envPath = path.join(process.cwd(), ".env");
-        await upsertEnvFile(envPath, filtered);
-
-        // Update process.env so the app picks up the new values immediately
-        for (const { key, value } of filtered) {
-          process.env[key] = value;
+        try {
+          const result = await saveKeyValuesToScopedSecrets(event, vars, scope);
+          return { saved: result.saved, storage: "scoped-secrets" };
+        } catch (err) {
+          if (err instanceof ScopedKeyStorageError) {
+            setResponseStatus(event, err.statusCode);
+            return { error: err.message };
+          }
+          setResponseStatus(event, 500);
+          return { error: "Failed to save keys" };
         }
-
-        // Notify parent (Builder or frame) via postMessage
-        agentEnv.setVars(filtered);
-
-        return { saved: filtered.map((v) => v.key) };
       }),
     );
   }
 
+  app.use(router);
   return { app, router };
 }

package/corpus/core/src/server/email-actions.ts

@@ -2,9 +2,8 @@
  * Framework-level agent action for sending transactional/notification emails
  * via the configured core email transport (Resend or SendGrid).
  *
- * Registered as a native tool in every template when RESEND_API_KEY or
- * SENDGRID_API_KEY is set. When neither key is present the tool is omitted
- * from the agent surface so the agent never sees it.
+ * Registered as a native tool in every template. sendEmail() checks the
+ * scoped Resend/SendGrid configuration at call time.
  *
  * SAFETY: the action description instructs the agent to draft-first and only
  * send when the user explicitly confirms, matching the mail template convention.
@@ -16,7 +15,7 @@
  */
 
 import type { ActionEntry } from "../agent/production-agent.js";
-import { isEmailConfigured, sendEmail } from "./email.js";
+import { sendEmail } from "./email.js";
 
 function markdownToText(md: string): string {
   return md
@@ -115,8 +114,6 @@ function markdownToHtml(md: string): string {
 }
 
 export function createCoreEmailActionEntries(): Record<string, ActionEntry> {
-  if (!isEmailConfigured()) return {};
-
   return {
     "core-send-email": {
       tool: {