@agent-native/core 0.88.0 → 0.90.1

package/corpus/core/src/server/core-routes-plugin.ts

@@ -515,8 +515,6 @@ async function detectUsageEngineName(
       { userEmail, orgId },
       () => detectEngineFromUserSecrets(),
     );
-    if (detectedFromUser?.name === "builder") return detectedFromUser.name;
-
     if (stored && typeof stored.engine === "string") {
       const entry = getAgentEngineEntry(stored.engine);
       if (
@@ -528,13 +526,13 @@ async function detectUsageEngineName(
         return stored.engine;
       }
     }
+    if (detectedFromUser?.name === "builder") return detectedFromUser.name;
     if (detectedFromUser) return detectedFromUser.name;
 
-    const canUseDeployEnv = await runWithRequestContext(
+    return await runWithRequestContext(
       { userEmail, orgId },
-      () => canUseDeployCredentialFallbackForRequest(),
+      () => detectEngineFromEnv()?.name ?? null,
     );
-    return canUseDeployEnv ? (detectEngineFromEnv()?.name ?? null) : null;
   } catch {
     return null;
   }
@@ -1115,6 +1113,95 @@ export function createCoreRoutesPlugin(
         );
       }
 
+      // ─── Durable sandbox execution processor ─────────────────────────
+      // Self-fired by run-code's background queue (see
+      // coding-tools/sandbox/background.ts): the enqueueing request POSTs here
+      // so the code executes in a FRESH invocation with its own budget instead
+      // of riding the ~40s agent-loop wall. Authenticity is verified via the
+      // shared HMAC internal-token scheme (same as the A2A / integration /
+      // agent-teams processors) plus the atomic SQL claim inside
+      // processQueuedSandboxExecution, which prevents double execution.
+      getH3App(nitroApp).use(
+        `${P}/sandbox/_process-execution`,
+        defineEventHandler(async (event) => {
+          if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+          }
+          const body = (await readBody(event).catch(() => null)) as {
+            executionId?: unknown;
+            taskId?: unknown;
+          } | null;
+          const executionId =
+            body && typeof body.executionId === "string" && body.executionId
+              ? body.executionId
+              : body && typeof body.taskId === "string"
+                ? body.taskId
+                : "";
+          if (!executionId) {
+            setResponseStatus(event, 400);
+            return { error: "executionId required" };
+          }
+
+          const { hasConfiguredA2ASecret, isA2AProductionRuntime } =
+            await import("../a2a/auth-policy.js");
+          if (hasConfiguredA2ASecret()) {
+            const { verifyInternalToken, extractBearerToken } =
+              await import("../integrations/internal-token.js");
+            const token = extractBearerToken(getHeader(event, "authorization"));
+            if (!verifyInternalToken(executionId, token ?? "")) {
+              setResponseStatus(event, 401);
+              return { error: "Invalid or expired processor token" };
+            }
+          } else if (isA2AProductionRuntime()) {
+            setResponseStatus(event, 503);
+            return {
+              error:
+                "Sandbox execution processor not configured — set A2A_SECRET on this deployment.",
+            };
+          }
+
+          try {
+            const { processQueuedSandboxExecution } =
+              await import("../coding-tools/sandbox/background.js");
+            const result = await processQueuedSandboxExecution(executionId);
+            return { ok: true, ...result };
+          } catch (err) {
+            console.error("[sandbox] _process-execution failed:", err);
+            setResponseStatus(event, 500);
+            return { error: "process-execution failed" };
+          }
+        }),
+      );
+
+      // ─── Durable sandbox execution sweep ──────────────────────────────
+      // Backstop for lost dispatches and dead executors: re-drives queued rows
+      // whose enqueue-time dispatch never landed and reclaims/reaps running
+      // rows whose lease expired. Cheap (one indexed query per 2-min window;
+      // a missing table short-circuits to a no-op) and best-effort — the
+      // poll-time drain in run-code covers deployments where warm-instance
+      // timers rarely fire.
+      (() => {
+        let lastSweep = 0;
+        const SWEEP_INTERVAL_MS = 2 * 60 * 1000;
+
+        setTimeout(() => {
+          setInterval(() => {
+            const now = Date.now();
+            if (now - lastSweep < SWEEP_INTERVAL_MS) return;
+            lastSweep = now;
+
+            (async () => {
+              const { drainDueSandboxExecutions } =
+                await import("../coding-tools/sandbox/background.js");
+              await drainDueSandboxExecutions({ limit: 5 });
+            })().catch(() => {
+              // best-effort — never break the server
+            });
+          }, 30_000); // Check every 30s but only sweep once per 2min
+        }, 25_000); // Start 25s after init (after the agent sweeps)
+      })();
+
       // Health + DB warmup — liveness probe that touches the database so
       // uptime monitors and the keep-warm cron prevent a scale-to-zero
       // serverless DB (e.g. Neon) from cold-starting on the next real
@@ -2498,8 +2585,9 @@ export function createCoreRoutesPlugin(
                   /* fall through to deployment env when allowed */
                 }
                 return (
-                  canUseDeployCredentialFallbackForRequest() &&
-                  !!readDeployCredentialEnv(OPENAI_BASE_URL_ENV_VAR)
+                  canUseDeployCredentialFallbackForRequest(
+                    OPENAI_BASE_URL_ENV_VAR,
+                  ) && !!readDeployCredentialEnv(OPENAI_BASE_URL_ENV_VAR)
                 );
               },
             );
@@ -2544,22 +2632,12 @@ export function createCoreRoutesPlugin(
             }
             // Per-user app_secrets — a user who connected Builder (or pasted
             // their own provider key) may not have any deploy-level env vars
-            // set, so check their per-user secret store before reporting "no
-            // engine configured" and re-showing the onboarding gate.
+            // set. Stored provider selections are checked first so saving a
+            // BYOK engine can override an existing Builder connection.
             const detectedFromUser = await runWithRequestContext(
               { userEmail, orgId },
               () => detectEngineFromUserSecrets(),
             );
-            if (detectedFromUser?.name === "builder") {
-              return {
-                configured: true,
-                engine: detectedFromUser.name,
-                model: detectedFromUser.defaultModel ?? DEFAULT_MODEL,
-                source: "app_secrets" as const,
-                envVar: detectedFromUser.requiredEnvVars[0],
-                openAiBaseUrlConfigured,
-              };
-            }
             if (stored && typeof stored.engine === "string") {
               const entry = getAgentEngineEntry(stored.engine);
               if (
@@ -2578,6 +2656,16 @@ export function createCoreRoutesPlugin(
                 };
               }
             }
+            if (detectedFromUser?.name === "builder") {
+              return {
+                configured: true,
+                engine: detectedFromUser.name,
+                model: detectedFromUser.defaultModel ?? DEFAULT_MODEL,
+                source: "app_secrets" as const,
+                envVar: detectedFromUser.requiredEnvVars[0],
+                openAiBaseUrlConfigured,
+              };
+            }
             if (detectedFromUser) {
               return {
                 configured: true,
@@ -2588,11 +2676,10 @@ export function createCoreRoutesPlugin(
                 openAiBaseUrlConfigured,
               };
             }
-            const canUseDeployEnv = await runWithRequestContext(
+            const detected = await runWithRequestContext(
               { userEmail, orgId },
-              () => canUseDeployCredentialFallbackForRequest(),
+              () => detectEngineFromEnv(),
             );
-            const detected = canUseDeployEnv ? detectEngineFromEnv() : null;
             if (detected) {
               return {
                 configured: true,
@@ -3054,6 +3141,16 @@ export function createCoreRoutesPlugin(
         // Extensions module not available — skip
       }
 
+      // ─── Data programs (stored server-side JS scripts + run cache) ─────
+      try {
+        const { ensureDataProgramTables, registerDataProgramsShareable } =
+          await import("../data-programs/store.js");
+        ensureDataProgramTables().catch(() => {});
+        registerDataProgramsShareable();
+      } catch {
+        // Data programs module not available — skip
+      }
+
       // ─── Page-level legacy redirect: /tools → /extensions ──────────────
       // Catches direct browser navigation / bookmarks for the old page route
       // (`/tools`, `/tools/:id`) and 302s to the renamed equivalent under

package/corpus/core/src/server/credential-provider.ts

@@ -73,11 +73,29 @@ export function readDeployCredentialEnv(key: string): string | undefined {
   return process.env[key] || undefined;
 }
 
+const APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS = new Set([
+  "ANTHROPIC_API_KEY",
+  "OPENAI_API_KEY",
+  "OPENAI_BASE_URL",
+  "OPENROUTER_API_KEY",
+  "GOOGLE_GENERATIVE_AI_API_KEY",
+  "GROQ_API_KEY",
+  "MISTRAL_API_KEY",
+  "COHERE_API_KEY",
+]);
+
+function isAppProvidedDeployCredentialKey(key: string | undefined): boolean {
+  return !!key && APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS.has(key);
+}
+
 /**
  * Deployment-level credentials are safe as a runtime fallback only in local /
  * single-tenant contexts. In hosted production with a shared database, every
- * signed-in user needs their own user/org/workspace credential so one deploy
- * key does not silently power another tenant's chat.
+ * signed-in user needs their own user/org/workspace credential for
+ * identity-bearing provider keys so one deploy key does not silently
+ * impersonate another tenant. App-provided LLM provider keys are different:
+ * they intentionally let the app developer pay for model usage for users of
+ * that deployed app, so key-aware callers may use those env vars.
  *
  * @deprecated Use `canUseDeployCredentialFallbackForRequest()` for generic
  * provider secrets. This stricter helper remains for legacy call sites with
@@ -88,9 +106,12 @@ export function isDeployCredentialFallbackAllowed(): boolean {
   return isLocalDatabase();
 }
 
-export function canUseDeployCredentialFallbackForRequest(): boolean {
+export function canUseDeployCredentialFallbackForRequest(
+  key?: string,
+): boolean {
   const email = getRequestUserEmail();
   if (!email) return true;
+  if (isAppProvidedDeployCredentialKey(key)) return true;
   if (isHostedWorkspaceRuntime()) return false;
   if (!isProductionLikeRuntime()) return true;
   return isLocalDatabase();
@@ -878,10 +899,9 @@ export async function deleteBuilderCredentials(
 // User-pasted and shared secrets live in `app_secrets` (encrypted). The
 // settings UI / onboarding panels can write user, org, or workspace rows.
 // Deploy-level env vars are the fallback for unauthenticated/CLI/background
-// contexts where there's no user to scope by — never the silent fallback
-// for an authenticated request, since on a multi-tenant deploy that would
-// silently identify every user as whoever set the deploy-level key
-// (KVesta Space, 2026-04).
+// contexts where there's no user to scope by. Authenticated requests may also
+// use app-provided LLM provider keys such as OPENAI_API_KEY or
+// ANTHROPIC_API_KEY, but Builder identity keys keep the stricter scoped policy.
 // ---------------------------------------------------------------------------
 
 /**
@@ -974,7 +994,7 @@ export async function resolveSecret(key: string): Promise<string | null> {
     const envFallback = (
       isBuilderCredentialKey(key)
         ? canUseBuilderDeployCredentialFallbackForRequest()
-        : canUseDeployCredentialFallbackForRequest()
+        : canUseDeployCredentialFallbackForRequest(key)
     )
       ? process.env[key] || null
       : null;

package/corpus/core/src/server/csrf.ts

@@ -62,6 +62,9 @@ const CSRF_ALLOWLIST_PREFIXES = [
   // Agent Teams durable sub-agent processor self-fire — verified by the same
   // HMAC internal-token scheme as the integration/A2A processors.
   "/agent-teams/",
+  // Durable sandbox-execution processor self-fire (run-code background
+  // queue) — verified by the same HMAC internal-token scheme.
+  "/sandbox/_process-execution",
   // A2A JSON-RPC endpoints — verified by signed JWT (when A2A_SECRET set) or
   // explicitly opt-in unauthenticated (handled at the A2A layer).
   "/a2a",

package/corpus/core/src/server/oauth-helpers.ts

@@ -15,7 +15,17 @@ export async function isOAuthConnected(
 ): Promise<boolean> {
   if (!forEmail) return false;
   const accounts = await listOAuthAccountsByOwner(provider, forEmail);
-  return accounts.length > 0;
+  // A row whose token bundle parses to an empty object is unusable — the
+  // typical cause is a stored record that failed to decrypt after a
+  // SECRETS_ENCRYPTION_KEY / BETTER_AUTH_SECRET rotation (parseStoredTokens
+  // returns `{}` rather than throwing). Counting it as "connected" hides the
+  // reconnect banner while every provider call fails with an undefined
+  // bearer token. Ignore empty records here; we deliberately do not delete
+  // them, because this process may simply hold the wrong key (e.g. a dev
+  // server sharing a prod DB) while the row is still decryptable elsewhere.
+  return accounts.some(
+    (account) => Object.keys(account.tokens ?? {}).length > 0,
+  );
 }
 
 /**

package/corpus/core/src/server/onboarding-html.ts

@@ -3279,13 +3279,16 @@ ${
     : `  var TAB_STORAGE_KEY = 'an.onboarding.tab';
     var tabs = document.querySelectorAll('.tab');
     var forms = document.querySelectorAll('.form');
-    var pendingSignupEmail = '';
-    var pendingSignupPassword = '';
-    var verificationCheckInFlight = false;
-    function setActiveTab(name, opts) {
-      if (name !== 'signup' && name !== 'login') return;
-      var form = document.getElementById(name + '-form');
-      if (!form) return;
+	    var pendingSignupEmail = '';
+	    var pendingSignupPassword = '';
+	    var verificationCheckInFlight = false;
+	    var RESEND_VERIFICATION_COOLDOWN_SECONDS = 60;
+	    var resendVerificationCooldownUntil = 0;
+	    var resendVerificationCooldownTimer = null;
+	    function setActiveTab(name, opts) {
+	      if (name !== 'signup' && name !== 'login') return;
+	      var form = document.getElementById(name + '-form');
+	      if (!form) return;
       var card = document.querySelector('.card');
       if (card) card.classList.remove('verifying');
       tabs.forEach(function(x) { x.classList.remove('active'); });
@@ -3340,13 +3343,21 @@ ${
     function __anNormalizeAuthEmail(value) {
       return String(value || '').trim().toLowerCase();
     }
-    function __anIsValidAuthEmail(value) {
-      return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(__anNormalizeAuthEmail(value));
-    }
-    function __anShowEmailValidationError(input, msg) {
-      if (msg) {
-        msg.textContent = __anT('invalidEmail');
-        msg.classList.add('show', 'error');
+	    function __anIsValidAuthEmail(value) {
+	      return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(__anNormalizeAuthEmail(value));
+	    }
+	    function __anIsVerifiedRedirectSuccess() {
+	      try {
+	        var params = new URLSearchParams(location.search);
+	        return params.has('verified') && !params.has('error');
+	      } catch (e) {
+	        return false;
+	      }
+	    }
+	    function __anShowEmailValidationError(input, msg) {
+	      if (msg) {
+	        msg.textContent = __anT('invalidEmail');
+	        msg.classList.add('show', 'error');
       }
       if (input && typeof input.focus === 'function') input.focus();
     }
@@ -3444,19 +3455,46 @@ ${
         }
       }
     }
-    function maybeCompleteVerificationAfterReturn() {
-      if (!isVerificationStepActive()) return;
-      checkVerificationSession(null, { silent: true });
-    }
-    async function resendVerificationEmail() {
-      var btn = document.getElementById('resend-verification');
-      var msg = document.getElementById('verify-msg');
-      var email = pendingSignupEmail || document.getElementById('s-email').value;
-      if (!email) return;
-      var original = btn ? btn.textContent : '';
-      if (btn) {
-        btn.disabled = true;
-        btn.textContent = __anT('sending');
+	    function maybeCompleteVerificationAfterReturn() {
+	      if (!isVerificationStepActive()) return;
+	      checkVerificationSession(null, { silent: true });
+	    }
+	    function updateResendVerificationCooldown() {
+	      var btn = document.getElementById('resend-verification');
+	      if (!btn) return;
+	      var remaining = Math.ceil((resendVerificationCooldownUntil - Date.now()) / 1000);
+	      if (remaining > 0) {
+	        btn.disabled = true;
+	        btn.textContent = __anT('resendEmail') + ' (' + remaining + 's)';
+	        return;
+	      }
+	      if (resendVerificationCooldownTimer) {
+	        clearInterval(resendVerificationCooldownTimer);
+	        resendVerificationCooldownTimer = null;
+	      }
+	      resendVerificationCooldownUntil = 0;
+	      btn.disabled = false;
+	      btn.textContent = __anT('resendEmail');
+	    }
+	    function startResendVerificationCooldown(seconds) {
+	      resendVerificationCooldownUntil = Date.now() + seconds * 1000;
+	      updateResendVerificationCooldown();
+	      if (resendVerificationCooldownTimer) clearInterval(resendVerificationCooldownTimer);
+	      resendVerificationCooldownTimer = setInterval(updateResendVerificationCooldown, 1000);
+	    }
+	    async function resendVerificationEmail() {
+	      var btn = document.getElementById('resend-verification');
+	      var msg = document.getElementById('verify-msg');
+	      var email = pendingSignupEmail || document.getElementById('s-email').value;
+	      if (!email) return;
+	      if (resendVerificationCooldownUntil > Date.now()) {
+	        updateResendVerificationCooldown();
+	        return;
+	      }
+	      var original = btn ? btn.textContent : '';
+	      if (btn) {
+	        btn.disabled = true;
+	        btn.textContent = __anT('sending');
       }
       if (msg) msg.classList.remove('show', 'error', 'success');
       try {
@@ -3466,21 +3504,15 @@ ${
           body: JSON.stringify({ email: email, callbackURL: __anGetReturnPath() }),
         });
         if (res.ok) {
-          if (msg) {
-            msg.textContent = __anT('sentVerification');
-            msg.classList.add('show', 'success');
-          }
-          if (btn) btn.textContent = __anT('sent');
-          setTimeout(function() {
-            if (btn) {
-              btn.disabled = false;
-              btn.textContent = original;
-            }
-          }, 1600);
-          return;
-        }
-        var data = await res.json().catch(function() { return {}; });
-        if (msg) {
+	          if (msg) {
+	            msg.textContent = __anT('sentVerification');
+	            msg.classList.add('show', 'success');
+	          }
+	          startResendVerificationCooldown(RESEND_VERIFICATION_COOLDOWN_SECONDS);
+	          return;
+	        }
+	        var data = await res.json().catch(function() { return {}; });
+	        if (msg) {
           msg.textContent = (data && (data.message || data.error)) || __anT('resendVerificationFailed');
           msg.classList.add('show', 'error');
         }
@@ -3508,9 +3540,9 @@ ${
       while (path.length > 1 && path.charAt(path.length - 1) === '/') path = path.slice(0, -1);
       if (qp === 'login' || qp === 'signup') {
         initial = qp;
-      } else if (params.has('verified')) {
-        initial = 'login';
-      } else if (path === '/login' || path.endsWith('/login')) {
+	      } else if (__anIsVerifiedRedirectSuccess()) {
+	        initial = 'login';
+	      } else if (path === '/login' || path.endsWith('/login')) {
         initial = 'login';
       } else if (path === '/signup' || path.endsWith('/signup')) {
         initial = 'signup';
@@ -3520,9 +3552,9 @@ ${
       }
     } catch (e) {}
     setActiveTab(initial, { persist: false });
-      try {
-        if (new URLSearchParams(location.search).has('verified')) {
-          var msg = document.getElementById('l-msg');
+	      try {
+	        if (__anIsVerifiedRedirectSuccess()) {
+	          var msg = document.getElementById('l-msg');
           if (msg) {
             msg.textContent = __anT('emailVerifiedFinishing');
             msg.classList.remove('error');

package/corpus/core/src/server/prompts/shared-rules.ts

@@ -61,7 +61,7 @@ export function sharedRule8(
   }
 
   if (databaseToolsMode === "read") {
-    return `8. **Read-only \`db-*\` tools are internal only** — \`db-schema\` and \`db-query\` ONLY inspect the app's own SQL database (settings, application_state, template tables). Raw SQL write tools such as \`db-exec\` and \`db-patch\` are not available on this surface; use typed app actions for writes. The DB tools CANNOT reach ${
+    return `8. **Read-only \`db-*\` tools are internal only** — \`db-schema\` and \`db-query\` ONLY inspect the app's own SQL database (settings, application_state, template tables); \`db-exec\` and \`db-patch\` are not available, so use typed app actions for writes. DB tools cannot reach ${
       providerList.length > 0
         ? providerList
             .split(",")
@@ -69,7 +69,7 @@ export function sharedRule8(
             .map((s) => s.trim())
             .join(", ")
         : "external data sources"
-    }, or any external data source. If the user asks about a table that is NOT in the app schema (e.g. \`dbt_analytics.*\`, \`dbt_mart.*\`, or any fully-qualified \`project.dataset.table\`), use the appropriate template action instead — ${warehouseExample}${providerExamples ? `${providerExamples} for their respective providers, ` : ""}etc. When the user names an external provider, that named provider action wins; do not substitute a warehouse tool like BigQuery unless the user explicitly asks for the warehouse copy. **Never use \`db-query\` for external data — it will fail.** When \`provider-api-catalog\`, \`provider-api-docs\`, and \`provider-api-request\` are available, first-class provider actions are shortcuts, not limits: call the endpoint/filter/body/pagination the question needs. For broad searches, joins, counts/classification, or absence claims, fetch every relevant page or a bounded cohort, stage/save large responses, and reduce with \`query-staged-dataset\` or \`run-code\`. Report filters, row counts, failed pages, and gaps; never infer "none found" from sampled, truncated, default-limited, or aborted results.${extensionAdvice}`;
+    } or any external source. If a table is NOT in the app schema, use the appropriate template action instead — ${warehouseExample}${providerExamples ? `${providerExamples} for their providers, ` : ""}etc. Named provider actions win over warehouse copies unless the user explicitly asks for the warehouse. **Never use \`db-query\` for external data.** When \`provider-api-catalog\`, \`provider-api-docs\`, and \`provider-api-request\` are available, first-class provider actions are shortcuts, not limits: call the endpoint/filter/body/pagination needed. For broad searches, joins, counts/classification, or absence claims, fetch every relevant page or bounded cohort, stage/save large responses, and reduce with \`query-staged-dataset\` or \`run-code\`. Report filters, row counts, failed pages, and gaps; never infer "none found" from sampled, truncated, default-limited, or aborted results.${extensionAdvice}`;
   }
 
   return `8. **\`db-*\` tools are internal only** — \`db-query\`, \`db-exec\`, \`db-patch\` ONLY access the app's own SQL database (settings, application_state, template tables). They CANNOT reach ${