@agent-native/core 0.84.57 → 0.84.58

package/dist/agent/production-agent.js

@@ -11,7 +11,7 @@ import { isMcpActionResult } from "../mcp-client/app-result.js";
 import { isMcpToolAllowedForRequest } from "../mcp-client/visibility.js";
 import { completeRun as completeProgressRun, startRun as startProgressRun, updateRunProgress, } from "../progress/registry.js";
 import { getFrontmatterValue, parseFrontmatter, } from "../resources/metadata.js";
-import { isDeployCredentialFallbackAllowed, readDeployCredentialEnv, } from "../server/credential-provider.js";
+import { canUseDeployCredentialFallbackForRequest, readDeployCredentialEnv, } from "../server/credential-provider.js";
 import { readBody } from "../server/h3-helpers.js";
 import { getRequestRunContext, ensureRequestRunContext, getRequestContext, getRequestOrgId, getRequestUserEmail, runWithRequestContext, } from "../server/request-context.js";
 import { fireInternalDispatch } from "../server/self-dispatch.js";
@@ -279,31 +279,16 @@ export async function getOwnerApiKey(provider, ownerEmail) {
 export function engineToProvider(engineName) {
     return engineName.startsWith("ai-sdk:") ? engineName.slice(7) : engineName;
 }
-/**
- * Returns true when this process should block generic deploy-level provider
- * credentials for signed-in chat requests.
- *
- * Self-hosted single-tenant deployments keep the env-var fallback so the
- * original BYO-server UX continues to work without a per-user key.
- */
-function shouldBlockDeployCredentialFallback() {
-    return !isDeployCredentialFallbackAllowed();
-}
 /**
  * Resolve the active engine's provider and look up the user's API key for it.
  *
- * In shared hosted deploys we deliberately refuse the deploy-level fallback
- * for authenticated users. Without that gate any
- * signed-in user who hasn't configured their own provider key would silently
- * inherit the deployment's key (uncapped billing on the owner's account,
- * prompt logging tied to the deployment owner) — exactly the prior-incident
- * pattern we hit on 2026-04-29.
- *
- * Single-tenant (local-dev, self-hosted SQLite) keeps the env fallback.
+ * If the owner has no scoped key, fall back to provider keys supplied by the
+ * hosting environment only when the current request can safely use deploy-level
+ * credentials. This is a read from process-level config, not a request-scoped
+ * write to `process.env`.
  *
- * Callers in `agent-chat-plugin.ts`, `triggers/dispatcher.ts`,
- * `jobs/scheduler.ts`, and `integrations/plugin.ts` historically layer
- * another deployment-key fallback after this must keep the same gate.
+ * Callers that layer another deployment-key fallback after this should keep the
+ * same precedence: scoped key first, host-provided env key second.
  */
 export async function getOwnerActiveApiKey(ownerEmail) {
     try {
@@ -314,14 +299,8 @@ export async function getOwnerActiveApiKey(ownerEmail) {
         const userKey = await getOwnerApiKey(provider, ownerEmail);
         if (userKey)
             return userKey;
-        if (shouldBlockDeployCredentialFallback()) {
-            // Shared hosted default: refuse the env fallback. A null user
-            // (unauthenticated / background context with no owner) gets undefined
-            // here too — there's no user to bill, and the call site must surface a
-            // "configure a key" error to the requester rather than silently using
-            // the deploy key.
+        if (!canUseDeployCredentialFallbackForRequest())
             return undefined;
-        }
         const envVar = PROVIDER_TO_ENV[provider];
         return envVar ? readDeployCredentialEnv(envVar) : undefined;
     }
@@ -417,6 +396,8 @@ function planModeBlockedMessage(toolName, reason) {
         ". Switch to Act mode after the user approves the plan, then retry the action.");
 }
 export function isPlanModeToolCallAllowed(name, input, entry) {
+    if (entry.allowInPlanMode === false)
+        return false;
     if (PLAN_MODE_BLOCKED_READONLY_TOOLS.has(name))
         return false;
     if (name === "web-request") {
@@ -498,6 +479,8 @@ export function createPlanModeActionRegistry(actions) {
     for (const [name, entry] of Object.entries(actions)) {
         if (name === TOOL_SEARCH_ACTION_NAME)
             continue;
+        if (entry.allowInPlanMode === false)
+            continue;
         if (PLAN_MODE_BLOCKED_READONLY_TOOLS.has(name))
             continue;
         const allowedActions = PLAN_MODE_ALLOWED_ACTIONS[name];
@@ -3625,15 +3608,13 @@ export function createProductionAgentHandler(options) {
         // for that provider instead of the global active engine's provider.
         // DIAGNOSTIC-ONLY: bracket per-owner API-key resolution (settings/app_secrets reads).
         workerStep("apikey_start");
+        const allowDeployCredentialFallback = canUseDeployCredentialFallbackForRequest();
         let userApiKey;
         if (requestEngine) {
             const provider = engineToProvider(requestEngine);
             userApiKey = await getOwnerApiKey(provider, ownerEmail);
-            if (!userApiKey && !shouldBlockDeployCredentialFallback()) {
-                // Single-tenant only: env fallback for the requested provider. Shared
-                // hosted deploys never silently substitute the deploy-level key for
-                // an authenticated user (see getOwnerActiveApiKey for the full
-                // rationale).
+            if (!userApiKey && allowDeployCredentialFallback) {
+                // Read-only env fallback for the requested provider.
                 const envVar = PROVIDER_TO_ENV[provider];
                 userApiKey = envVar ? readDeployCredentialEnv(envVar) : undefined;
             }
@@ -3644,16 +3625,12 @@ export function createProductionAgentHandler(options) {
         // DIAGNOSTIC-ONLY: API-key resolution finished.
         workerStep("apikey_done");
         // `options.apiKey` is the value the template constructed the plugin with
-        // (e.g. wired from a deployment env var). On a shared hosted deploy this
-        // is the same cross-tenant hazard as any deploy-level provider key:
-        // accepting it as the final fallback would silently bill every key-less
-        // user to the deployment's account. Honour it only when the generic
-        // deploy fallback policy allows it.
-        const effectiveApiKey = shouldBlockDeployCredentialFallback()
-            ? userApiKey
-            : (userApiKey ??
-                options.apiKey ??
-                readDeployCredentialEnv("ANTHROPIC_API_KEY"));
+        // (often wired from a deployment env var). Honor it as host-provided
+        // read-only configuration after scoped keys when deploy fallback is safe.
+        const hostApiKey = allowDeployCredentialFallback
+            ? (options.apiKey ?? readDeployCredentialEnv("ANTHROPIC_API_KEY"))
+            : undefined;
+        const effectiveApiKey = userApiKey ?? hostApiKey;
         // Resolve engine — per-request engine override takes priority
         // DIAGNOSTIC-ONLY: bracket engine resolution (Builder credential / app-default
         // settings reads inside resolveEngine).