@agent-native/core 0.79.17 → 0.79.19

package/corpus/core/src/integrations/adapters/email.ts

@@ -5,6 +5,7 @@ import { getHeader, readRawBody as h3ReadRawBody } from "h3";
 
 import { getDbExec } from "../../db/client.js";
 import type { EnvKeyConfig } from "../../server/create-server.js";
+import { resolveSecret } from "../../server/credential-provider.js";
 import {
   sendEmail,
   isEmailConfigured,
@@ -113,8 +114,9 @@ export function emailAdapter(): PlatformAdapter {
     },
 
     async verifyWebhook(event: H3Event): Promise<boolean> {
-      const secret = process.env.EMAIL_INBOUND_WEBHOOK_SECRET;
-      const provider = getEmailProvider();
+      const secret =
+        (await resolveSecret("EMAIL_INBOUND_WEBHOOK_SECRET")) ?? undefined;
+      const provider = await getEmailProvider();
 
       if (provider === "resend") {
         return verifyResendWebhook(event, secret);
@@ -132,8 +134,10 @@ export function emailAdapter(): PlatformAdapter {
     async parseIncomingMessage(
       event: H3Event,
     ): Promise<IncomingMessage | null> {
-      const provider = getEmailProvider();
-      const agentAddress = process.env.EMAIL_AGENT_ADDRESS?.toLowerCase();
+      const provider = await getEmailProvider();
+      const agentAddress = (
+        await resolveSecret("EMAIL_AGENT_ADDRESS")
+      )?.toLowerCase();
       if (!agentAddress) {
         console.warn("[email] EMAIL_AGENT_ADDRESS not configured");
         return null;
@@ -246,7 +250,7 @@ export function emailAdapter(): PlatformAdapter {
       message: OutgoingMessage,
       context: IncomingMessage,
     ): Promise<void> {
-      const agentAddress = process.env.EMAIL_AGENT_ADDRESS;
+      const agentAddress = await resolveSecret("EMAIL_AGENT_ADDRESS");
       if (!agentAddress) {
         console.error("[email] EMAIL_AGENT_ADDRESS not configured");
         return;
@@ -259,9 +263,8 @@ export function emailAdapter(): PlatformAdapter {
       // EMAIL_FROM overrides the from-address — required when the receiving
       // address is on a sub-domain that can't be a verified sender (e.g.
       // *.resend.app). Inbound and outbound addresses can differ.
-      const fromAddress = process.env.EMAIL_FROM
-        ? process.env.EMAIL_FROM
-        : `${displayName} <${agentAddress}>`;
+      const emailFrom = await resolveSecret("EMAIL_FROM");
+      const fromAddress = emailFrom || `${displayName} <${agentAddress}>`;
 
       const subject = context.platformContext.subject as string;
       const reSubject = subject.startsWith("Re: ") ? subject : `Re: ${subject}`;
@@ -276,7 +279,7 @@ export function emailAdapter(): PlatformAdapter {
           inReplyTo: context.platformContext.messageId as string,
           references: buildReferencesHeader(context.platformContext),
           cc: context.platformContext.isCC
-            ? buildReplyAllCc(context)
+            ? buildReplyAllCc(context, agentAddress)
             : undefined,
         });
       } catch (err) {
@@ -288,7 +291,7 @@ export function emailAdapter(): PlatformAdapter {
       message: OutgoingMessage,
       target: OutboundTarget,
     ): Promise<void> {
-      const agentAddress = process.env.EMAIL_AGENT_ADDRESS;
+      const agentAddress = await resolveSecret("EMAIL_AGENT_ADDRESS");
       if (!agentAddress) {
         console.error("[email] EMAIL_AGENT_ADDRESS not configured");
         return;
@@ -325,9 +328,11 @@ export function emailAdapter(): PlatformAdapter {
     },
 
     async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {
-      const hasAgentAddress = !!process.env.EMAIL_AGENT_ADDRESS;
-      const hasEmailProvider = isEmailConfigured();
-      const hasWebhookSecret = !!process.env.EMAIL_INBOUND_WEBHOOK_SECRET;
+      const hasAgentAddress = !!(await resolveSecret("EMAIL_AGENT_ADDRESS"));
+      const hasEmailProvider = await isEmailConfigured();
+      const hasWebhookSecret = !!(await resolveSecret(
+        "EMAIL_INBOUND_WEBHOOK_SECRET",
+      ));
       const configured = hasAgentAddress && hasEmailProvider;
 
       return {
@@ -339,10 +344,10 @@ export function emailAdapter(): PlatformAdapter {
           hasAgentAddress,
           hasEmailProvider,
           hasWebhookSecret,
-          provider: getEmailProvider(),
+          provider: await getEmailProvider(),
         },
         error: !configured
-          ? "Set EMAIL_AGENT_ADDRESS and either RESEND_API_KEY or SENDGRID_API_KEY"
+          ? "Save EMAIL_AGENT_ADDRESS and either RESEND_API_KEY or SENDGRID_API_KEY in settings"
           : undefined,
       };
     },
@@ -906,8 +911,11 @@ function buildReferencesHeader(ctx: Record<string, unknown>): string {
  * Build CC list for reply-all when agent was CC'd.
  * Include original To addresses and other CC addresses, excluding the agent and the original sender.
  */
-function buildReplyAllCc(context: IncomingMessage): string[] | undefined {
-  const agentAddress = process.env.EMAIL_AGENT_ADDRESS?.toLowerCase();
+function buildReplyAllCc(
+  context: IncomingMessage,
+  agentAddress: string,
+): string[] | undefined {
+  const normalizedAgentAddress = agentAddress.toLowerCase();
   const senderEmail = context.senderId?.toLowerCase();
   const toAddresses = (context.platformContext.to as string[]) || [];
   const ccAddresses = (context.platformContext.cc as string[]) || [];
@@ -916,7 +924,7 @@ function buildReplyAllCc(context: IncomingMessage): string[] | undefined {
   for (const addr of [...toAddresses, ...ccAddresses]) {
     const normalized = addr.toLowerCase().trim();
     // Exclude agent address and original sender (sender goes in To)
-    if (normalized !== agentAddress && normalized !== senderEmail) {
+    if (normalized !== normalizedAgentAddress && normalized !== senderEmail) {
       allRecipients.add(normalized);
     }
   }

package/corpus/core/src/integrations/adapters/slack.ts

@@ -2,6 +2,7 @@ import type { H3Event } from "h3";
 import { createError, getHeader, readRawBody } from "h3";
 
 import type { EnvKeyConfig } from "../../server/create-server.js";
+import { resolveSecret } from "../../server/credential-provider.js";
 import type {
   PlatformAdapter,
   IncomingMessage,
@@ -80,7 +81,7 @@ export function slackAdapter(): PlatformAdapter {
     },
 
     async verifyWebhook(event: H3Event): Promise<boolean> {
-      const signingSecret = process.env.SLACK_SIGNING_SECRET;
+      const signingSecret = await resolveSecret("SLACK_SIGNING_SECRET");
       if (!signingSecret) return false;
 
       const signature = getHeader(event, "x-slack-signature");
@@ -185,7 +186,7 @@ export function slackAdapter(): PlatformAdapter {
       // redundant and added an extra chunk that we then had to overwrite.
       // We just set the native status and return null so sendResponse posts
       // the final reply as a fresh message.
-      const token = process.env.SLACK_BOT_TOKEN;
+      const token = await resolveSecret("SLACK_BOT_TOKEN");
       if (!token) return null;
 
       const channelId = incoming.platformContext.channelId as string;
@@ -204,7 +205,7 @@ export function slackAdapter(): PlatformAdapter {
       context: IncomingMessage,
       opts?: { placeholderRef?: string },
     ): Promise<void> {
-      const token = process.env.SLACK_BOT_TOKEN;
+      const token = await resolveSecret("SLACK_BOT_TOKEN");
       if (!token) {
         console.error("[slack] SLACK_BOT_TOKEN not configured");
         return;
@@ -297,7 +298,7 @@ export function slackAdapter(): PlatformAdapter {
       message: OutgoingMessage,
       target: OutboundTarget,
     ): Promise<void> {
-      const token = process.env.SLACK_BOT_TOKEN;
+      const token = await resolveSecret("SLACK_BOT_TOKEN");
       if (!token) {
         console.error("[slack] SLACK_BOT_TOKEN not configured");
         return;
@@ -348,8 +349,8 @@ export function slackAdapter(): PlatformAdapter {
     },
 
     async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {
-      const hasToken = !!process.env.SLACK_BOT_TOKEN;
-      const hasSecret = !!process.env.SLACK_SIGNING_SECRET;
+      const hasToken = !!(await resolveSecret("SLACK_BOT_TOKEN"));
+      const hasSecret = !!(await resolveSecret("SLACK_SIGNING_SECRET"));
       const configured = hasToken && hasSecret;
 
       return {
@@ -362,7 +363,7 @@ export function slackAdapter(): PlatformAdapter {
           hasSecret,
         },
         error: !configured
-          ? "Set SLACK_BOT_TOKEN and SLACK_SIGNING_SECRET in your environment"
+          ? "Save SLACK_BOT_TOKEN and SLACK_SIGNING_SECRET in settings"
           : undefined,
       };
     },

package/corpus/core/src/integrations/adapters/telegram.ts

@@ -2,6 +2,7 @@ import type { H3Event } from "h3";
 import { getHeader } from "h3";
 
 import type { EnvKeyConfig } from "../../server/create-server.js";
+import { resolveSecret } from "../../server/credential-provider.js";
 import { readBody } from "../../server/h3-helpers.js";
 import type {
   PlatformAdapter,
@@ -86,7 +87,7 @@ export function telegramAdapter(): PlatformAdapter {
     },
 
     async verifyWebhook(event: H3Event): Promise<boolean> {
-      const secret = process.env.TELEGRAM_WEBHOOK_SECRET;
+      const secret = await resolveSecret("TELEGRAM_WEBHOOK_SECRET");
       if (!secret) {
         if (shouldRefuseWhenSecretMissing()) {
           if (!_telegramUnverifiedWarned) {
@@ -105,7 +106,7 @@ export function telegramAdapter(): PlatformAdapter {
           );
         }
         // Dev mode: still require the bot token to be configured at all.
-        return !!process.env.TELEGRAM_BOT_TOKEN;
+        return !!(await resolveSecret("TELEGRAM_BOT_TOKEN"));
       }
 
       const headerSecret = getHeader(event, "x-telegram-bot-api-secret-token");
@@ -172,7 +173,7 @@ export function telegramAdapter(): PlatformAdapter {
       message: OutgoingMessage,
       context: IncomingMessage,
     ): Promise<void> {
-      const token = process.env.TELEGRAM_BOT_TOKEN;
+      const token = await resolveSecret("TELEGRAM_BOT_TOKEN");
       if (!token) {
         console.error("[telegram] TELEGRAM_BOT_TOKEN not configured");
         return;
@@ -224,7 +225,7 @@ export function telegramAdapter(): PlatformAdapter {
       message: OutgoingMessage,
       target: OutboundTarget,
     ): Promise<void> {
-      const token = process.env.TELEGRAM_BOT_TOKEN;
+      const token = await resolveSecret("TELEGRAM_BOT_TOKEN");
       if (!token) {
         console.error("[telegram] TELEGRAM_BOT_TOKEN not configured");
         return;
@@ -272,14 +273,13 @@ export function telegramAdapter(): PlatformAdapter {
     },
 
     async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {
-      const hasToken = !!process.env.TELEGRAM_BOT_TOKEN;
+      const token = await resolveSecret("TELEGRAM_BOT_TOKEN");
+      const hasToken = !!token;
 
       let botName: string | undefined;
       if (hasToken) {
         try {
-          const res = await fetch(
-            `https://api.telegram.org/bot${process.env.TELEGRAM_BOT_TOKEN}/getMe`,
-          );
+          const res = await fetch(`https://api.telegram.org/bot${token}/getMe`);
           const data = (await res.json()) as {
             ok: boolean;
             result?: { username?: string };
@@ -299,9 +299,7 @@ export function telegramAdapter(): PlatformAdapter {
           hasToken,
           botUsername: botName,
         },
-        error: !hasToken
-          ? "Set TELEGRAM_BOT_TOKEN in your environment"
-          : undefined,
+        error: !hasToken ? "Save TELEGRAM_BOT_TOKEN in settings" : undefined,
       };
     },
   };

package/corpus/core/src/integrations/adapters/whatsapp.ts

@@ -2,6 +2,7 @@ import type { H3Event } from "h3";
 import { getQuery, getHeader, readRawBody as h3ReadRawBody } from "h3";
 
 import type { EnvKeyConfig } from "../../server/create-server.js";
+import { resolveSecret } from "../../server/credential-provider.js";
 import type {
   PlatformAdapter,
   IncomingMessage,
@@ -103,7 +104,7 @@ export function whatsappAdapter(): PlatformAdapter {
       const mode = query["hub.mode"];
       const token = query["hub.verify_token"];
       const challenge = query["hub.challenge"];
-      const expected = process.env.WHATSAPP_VERIFY_TOKEN;
+      const expected = await resolveSecret("WHATSAPP_VERIFY_TOKEN");
 
       if (mode === "subscribe" && expected && typeof token === "string") {
         // Timing-safe compare so an attacker can't measure character-wise
@@ -126,7 +127,7 @@ export function whatsappAdapter(): PlatformAdapter {
     },
 
     async verifyWebhook(event: H3Event): Promise<boolean> {
-      const appSecret = process.env.WHATSAPP_APP_SECRET;
+      const appSecret = await resolveSecret("WHATSAPP_APP_SECRET");
       if (!appSecret) {
         if (shouldRefuseWhenSecretMissing()) {
           if (!_whatsappUnverifiedWarned) {
@@ -145,7 +146,7 @@ export function whatsappAdapter(): PlatformAdapter {
           );
         }
         // Dev mode: still require the access token to be configured at all.
-        return !!process.env.WHATSAPP_ACCESS_TOKEN;
+        return !!(await resolveSecret("WHATSAPP_ACCESS_TOKEN"));
       }
 
       const signature = getHeader(event, "x-hub-signature-256");
@@ -223,8 +224,8 @@ export function whatsappAdapter(): PlatformAdapter {
       message: OutgoingMessage,
       context: IncomingMessage,
     ): Promise<void> {
-      const accessToken = process.env.WHATSAPP_ACCESS_TOKEN;
-      const phoneNumberId = process.env.WHATSAPP_PHONE_NUMBER_ID;
+      const accessToken = await resolveSecret("WHATSAPP_ACCESS_TOKEN");
+      const phoneNumberId = await resolveSecret("WHATSAPP_PHONE_NUMBER_ID");
       if (!accessToken || !phoneNumberId) {
         console.error(
           "[whatsapp] WHATSAPP_ACCESS_TOKEN or WHATSAPP_PHONE_NUMBER_ID not configured",
@@ -269,9 +270,11 @@ export function whatsappAdapter(): PlatformAdapter {
     },
 
     async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {
-      const hasAccessToken = !!process.env.WHATSAPP_ACCESS_TOKEN;
-      const hasVerifyToken = !!process.env.WHATSAPP_VERIFY_TOKEN;
-      const hasPhoneNumberId = !!process.env.WHATSAPP_PHONE_NUMBER_ID;
+      const hasAccessToken = !!(await resolveSecret("WHATSAPP_ACCESS_TOKEN"));
+      const hasVerifyToken = !!(await resolveSecret("WHATSAPP_VERIFY_TOKEN"));
+      const hasPhoneNumberId = !!(await resolveSecret(
+        "WHATSAPP_PHONE_NUMBER_ID",
+      ));
       const configured = hasAccessToken && hasVerifyToken && hasPhoneNumberId;
 
       return {
@@ -285,7 +288,7 @@ export function whatsappAdapter(): PlatformAdapter {
           hasPhoneNumberId,
         },
         error: !configured
-          ? "Set WHATSAPP_ACCESS_TOKEN, WHATSAPP_VERIFY_TOKEN, and WHATSAPP_PHONE_NUMBER_ID"
+          ? "Save WHATSAPP_ACCESS_TOKEN, WHATSAPP_VERIFY_TOKEN, and WHATSAPP_PHONE_NUMBER_ID in settings"
           : undefined,
       };
     },

package/corpus/core/src/integrations/plugin.ts

@@ -2,16 +2,18 @@ import { defineEventHandler, setResponseStatus, getMethod, getQuery } from "h3";
 import { getRequestHeader } from "h3";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 
-import { getOrgContext } from "../org/context.js";
+import { getOrgContext, resolveOrgIdForEmail } from "../org/context.js";
 import { loadResourcesForPrompt } from "../server/agent-chat-plugin.js";
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
 import { getSession } from "../server/auth.js";
 import { FRAMEWORK_ROUTE_PREFIX } from "../server/core-routes-plugin.js";
+import { resolveSecret } from "../server/credential-provider.js";
 import {
   getH3App,
   markDefaultPluginProvided,
 } from "../server/framework-request-handler.js";
 import { readBody } from "../server/h3-helpers.js";
+import { runWithRequestContext } from "../server/request-context.js";
 import {
   processA2AContinuationById,
   processDueA2AContinuations,
@@ -175,6 +177,12 @@ type RemoteCodeCommandEnvelope = {
   source?: unknown;
 };
 
+type IntegrationCredentialContext = {
+  userEmail: string;
+  orgId?: string;
+  isIntegrationCaller?: boolean;
+};
+
 const REMOTE_DEVICE_ONLINE_MS = 90_000;
 
 export async function enqueueRemoteCommand(
@@ -517,8 +525,7 @@ export function createIntegrationsPlugin(
     // init can leave us with an empty string forever. The getter
     // re-resolves on every webhook so freshly-set secrets work without
     // a redeploy.
-    const getApiKey = () =>
-      options?.apiKey ?? process.env.ANTHROPIC_API_KEY ?? "";
+    const getApiKey = () => options?.apiKey ?? "";
 
     // Build the system prompt
     const baseSystemPrompt = options?.systemPrompt ?? INTEGRATION_SYSTEM_PROMPT;
@@ -569,6 +576,39 @@ export function createIntegrationsPlugin(
       };
     }
 
+    function toCredentialContext(
+      ctx: { ownerEmail: string; orgId: string | null },
+      opts?: { isIntegrationCaller?: boolean },
+    ): IntegrationCredentialContext {
+      return {
+        userEmail: ctx.ownerEmail,
+        ...(ctx.orgId ? { orgId: ctx.orgId } : {}),
+        ...(opts?.isIntegrationCaller ? { isIntegrationCaller: true } : {}),
+      };
+    }
+
+    async function credentialContextForIntegrationConfig(
+      config: Awaited<ReturnType<typeof getIntegrationConfig>>,
+    ): Promise<IntegrationCredentialContext | null> {
+      const ownerEmail =
+        typeof config?.owner === "string" ? config.owner.trim() : "";
+      if (!ownerEmail) return null;
+      const orgId = await resolveOrgIdForEmail(ownerEmail).catch(() => null);
+      return {
+        userEmail: ownerEmail,
+        ...(orgId ? { orgId } : {}),
+        isIntegrationCaller: true,
+      };
+    }
+
+    async function withCredentialContext<T>(
+      context: IntegrationCredentialContext | null,
+      fn: () => Promise<T>,
+    ): Promise<T> {
+      if (!context) return fn();
+      return runWithRequestContext(context, fn);
+    }
+
     async function requireRemoteDevice(event: any) {
       const token = extractBearerToken(
         getRequestHeader(event, "authorization"),
@@ -627,11 +667,15 @@ export function createIntegrationsPlugin(
           setResponseStatus(event, 405);
           return { error: "Method not allowed" };
         }
-        if (!(await requireSession(event))) return { error: "unauthorized" };
         const baseUrl = getBaseUrl(event);
+        const ctx = await requireSessionContext(event);
+        if (!ctx) return { error: "unauthorized" };
+        const credentialContext = toCredentialContext(ctx);
         const statuses: IntegrationStatus[] = [];
         for (const adapter of adapters) {
-          const status = await adapter.getStatus(baseUrl);
+          const status = await withCredentialContext(credentialContext, () =>
+            adapter.getStatus(baseUrl),
+          );
           const config = await getIntegrationConfig(adapter.platform);
           status.enabled = !!config?.configData?.enabled;
           status.webhookUrl = `${baseUrl}${P}/${adapter.platform}/webhook`;
@@ -1422,9 +1466,13 @@ export function createIntegrationsPlugin(
 
         // ─── GET /:platform/status ─────────────────────────────
         if (action === "status" && method === "GET") {
-          if (!(await requireSession(event))) return { error: "unauthorized" };
+          const ctx = await requireSessionContext(event);
+          if (!ctx) return { error: "unauthorized" };
           const baseUrl = getBaseUrl(event);
-          const status = await adapter.getStatus(baseUrl);
+          const status = await withCredentialContext(
+            toCredentialContext(ctx),
+            () => adapter.getStatus(baseUrl),
+          );
           const config = await getIntegrationConfig(platform);
           status.enabled = !!config?.configData?.enabled;
           status.webhookUrl = `${baseUrl}${P}/${platform}/webhook`;
@@ -1482,14 +1530,20 @@ export function createIntegrationsPlugin(
             return "ok";
           }
 
+          const config = await getIntegrationConfig(platform);
+          const credentialContext =
+            await credentialContextForIntegrationConfig(config);
+
           // Handle platform verification challenges (e.g. Slack url_verification)
           // before checking enable state or parsing the message.
-          const verification = await adapter.handleVerification(event);
+          const verification = await withCredentialContext(
+            credentialContext,
+            () => adapter.handleVerification(event),
+          );
           if (verification.handled) {
             return verification.response ?? "ok";
           }
 
-          const config = await getIntegrationConfig(platform);
           if (!config?.configData?.enabled) {
             setResponseStatus(event, 404);
             return { error: `Integration ${platform} is not enabled` };
@@ -1500,13 +1554,17 @@ export function createIntegrationsPlugin(
           // hangs on streaming providers), and that means handleWebhook's
           // own verifyWebhook step is bypassed. Without this call anyone
           // could POST a forged Slack/Telegram/email payload.
-          const isValid = await adapter.verifyWebhook(event);
+          const isValid = await withCredentialContext(credentialContext, () =>
+            adapter.verifyWebhook(event),
+          );
           if (!isValid) {
             setResponseStatus(event, 401);
             return { error: "Invalid webhook signature" };
           }
 
-          const incoming = await adapter.parseIncomingMessage(event);
+          const incoming = await withCredentialContext(credentialContext, () =>
+            adapter.parseIncomingMessage(event),
+          );
           if (!incoming) {
             setResponseStatus(event, 200);
             return "ok";
@@ -1582,10 +1640,18 @@ export function createIntegrationsPlugin(
           if (platform === "telegram") {
             const baseUrl = getBaseUrl(event);
             const webhookUrl = `${baseUrl}${P}/telegram/webhook`;
-            const token = process.env.TELEGRAM_BOT_TOKEN;
+            const ctx = await requireSessionContext(event);
+            if (!ctx) return { error: "unauthorized" };
+            const token = await withCredentialContext(
+              toCredentialContext(ctx),
+              () => resolveSecret("TELEGRAM_BOT_TOKEN"),
+            );
             if (!token) {
               setResponseStatus(event, 400);
-              return { error: "TELEGRAM_BOT_TOKEN not configured" };
+              return {
+                error:
+                  "TELEGRAM_BOT_TOKEN not configured. Save it in settings.",
+              };
             }
             try {
               const res = await fetch(

package/corpus/core/src/onboarding/default-steps.ts

@@ -17,6 +17,7 @@ import {
 import {
   canUseDeployCredentialFallbackForRequest,
   readDeployCredentialEnv,
+  resolveSecret,
 } from "../server/credential-provider.js";
 import { getSetting } from "../settings/store.js";
 import { registerOnboardingStep } from "./registry.js";
@@ -287,12 +288,14 @@ const emailStep: OnboardingStep = {
       },
     },
   ],
-  isComplete: () => {
-    if (process.env.RESEND_API_KEY) return true;
+  isComplete: async () => {
+    if (await resolveSecret("RESEND_API_KEY")) return true;
     // SendGrid rejects Resend's sandbox sender, so EMAIL_FROM must also be
     // set — otherwise sendEmail() throws at runtime even though the API key
     // is configured.
-    if (process.env.SENDGRID_API_KEY) return !!process.env.EMAIL_FROM;
+    if (await resolveSecret("SENDGRID_API_KEY")) {
+      return !!(await resolveSecret("EMAIL_FROM"));
+    }
     return false;
   },
 };

package/corpus/core/src/onboarding/types.ts

@@ -9,7 +9,7 @@
 
 export type OnboardingMethodBadge = "recommended" | "beta" | "free" | "soon";
 
-/** Fields for a form-style onboarding method (key/value env-var entry). */
+/** Fields for a form-style onboarding method (key/value secret entry). */
 export interface OnboardingFormField {
   key: string;
   label: string;

package/corpus/core/src/org/handlers.ts

@@ -312,7 +312,7 @@ async function inviteOne(
 
   let emailSent = false;
   let emailError: string | undefined;
-  if (isEmailConfigured()) {
+  if (await isEmailConfigured()) {
     try {
       const { subject, html, text } = renderInviteEmail({
         invitee: email,

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -5435,10 +5435,7 @@ export function createAgentChatPlugin(
               // Sub-agents must inherit the parent run's resolved key so
               // delegations spawned by agent-teams don't silently fall back
               // to the platform key while the parent uses BYO credentials.
-              apiKey:
-                runCtx?.userApiKey ??
-                options?.apiKey ??
-                process.env.ANTHROPIC_API_KEY,
+              apiKey: runCtx?.userApiKey ?? options?.apiKey,
             })
           );
         },
@@ -6949,7 +6946,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
           const { getOwnerActiveApiKey } =
             await import("../agent/production-agent.js");
           const userApiKey = await getOwnerActiveApiKey(ownerEmail);
-          const apiKey = userApiKey ?? process.env.ANTHROPIC_API_KEY;
+          const apiKey = userApiKey;
           if (!apiKey) {
             // Fallback: truncate the message
             return { title: cleanMessage.trim().slice(0, 60) };
@@ -7985,7 +7982,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
               : await buildSchemaBlock(owner, databaseToolsMode);
             return basePrompt + resources + schemaBlock;
           },
-          apiKey: options?.apiKey ?? process.env.ANTHROPIC_API_KEY,
+          apiKey: options?.apiKey,
           model: options?.model,
           appId: options?.appId,
         };
@@ -8084,7 +8081,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
               : await buildSchemaBlock(owner, databaseToolsMode);
             return basePrompt + resources + schemaBlock;
           },
-          apiKey: options?.apiKey ?? process.env.ANTHROPIC_API_KEY,
+          apiKey: options?.apiKey,
           model: options?.model,
           appId: options?.appId,
         });