@agent-native/core 0.91.2 → 0.92.0

package/corpus/core/src/client/settings/SettingsSection.tsx

@@ -1,5 +1,36 @@
 import { IconChevronDown, IconCheck } from "@tabler/icons-react";
-import type { ReactNode } from "react";
+import { createContext, useContext, type ReactNode } from "react";
+
+import { cn } from "../utils.js";
+
+/**
+ * Where a settings section is being rendered.
+ *
+ * - `sidebar`: the compact agent sidebar panel (dense, small type).
+ * - `page`: the full-width settings page, styled as a polished card that
+ *   matches the shadcn `Card` surface used by app-owned settings tabs.
+ */
+export type SettingsSurface = "sidebar" | "page";
+
+const SettingsSurfaceContext = createContext<SettingsSurface>("sidebar");
+
+export function SettingsSurfaceProvider({
+  surface,
+  children,
+}: {
+  surface: SettingsSurface;
+  children: ReactNode;
+}) {
+  return (
+    <SettingsSurfaceContext.Provider value={surface}>
+      {children}
+    </SettingsSurfaceContext.Provider>
+  );
+}
+
+export function useSettingsSurface(): SettingsSurface {
+  return useContext(SettingsSurfaceContext);
+}
 
 interface SettingsSectionProps {
   id?: string;
@@ -15,10 +46,126 @@ interface SettingsSectionProps {
 }
 
 /**
- * Collapsible settings section card with icon, title, status dot, and optional badge.
- * Controlled via `open` / `onToggle` for accordion behaviour.
+ * Collapsible settings section. Renders as a compact row in the agent sidebar
+ * and as a polished, shadcn-style card on the full settings page (so the
+ * framework tabs match app-owned General/Team cards). The visual surface is
+ * read from `SettingsSurfaceContext`.
  */
-export function SettingsSection({
+export function SettingsSection(props: SettingsSectionProps) {
+  const surface = useSettingsSurface();
+  return surface === "page" ? (
+    <PageSettingsSection {...props} />
+  ) : (
+    <SidebarSettingsSection {...props} />
+  );
+}
+
+function ConnectedDot({ size }: { size: "sm" | "md" }) {
+  const dim = size === "sm" ? "h-4 w-4" : "h-5 w-5";
+  const stroke = size === "sm" ? 3 : 2.5;
+  const glyph = size === "sm" ? 10 : 12;
+  return (
+    <span
+      className={cn(
+        "flex shrink-0 items-center justify-center rounded-full bg-green-500/15 text-green-500",
+        dim,
+      )}
+    >
+      <IconCheck size={glyph} stroke={stroke} />
+    </span>
+  );
+}
+
+function StatusBadge({
+  label,
+  tone,
+  size,
+}: {
+  label: string;
+  tone: "muted" | "required";
+  size: "sm" | "md";
+}) {
+  return (
+    <span
+      className={cn(
+        "shrink-0 rounded-full font-semibold uppercase tracking-wide",
+        size === "sm" ? "px-1.5 py-0.5 text-[9px]" : "px-2 py-0.5 text-[10px]",
+        tone === "required"
+          ? "bg-amber-500/15 text-amber-600 dark:text-amber-400"
+          : "bg-muted text-muted-foreground",
+      )}
+    >
+      {label}
+    </span>
+  );
+}
+
+function PageSettingsSection({
+  id,
+  icon,
+  title,
+  subtitle,
+  badge,
+  required,
+  connected,
+  open = false,
+  onToggle,
+  children,
+}: SettingsSectionProps) {
+  return (
+    <div
+      id={id}
+      className={cn(
+        "scroll-mt-16 overflow-hidden rounded-lg border bg-card text-card-foreground shadow-sm transition-colors",
+        open ? "border-border" : "border-border/60",
+      )}
+    >
+      <button
+        type="button"
+        onClick={onToggle}
+        aria-expanded={open}
+        className="flex w-full items-start justify-between gap-4 px-5 py-4 text-start transition-colors hover:bg-muted/40 sm:px-6 sm:py-5"
+      >
+        <div className="flex min-w-0 items-start gap-3">
+          <span className="mt-0.5 flex size-8 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground [&>svg]:size-[18px]">
+            {icon}
+          </span>
+          <span className="flex min-w-0 flex-col gap-1.5">
+            <span className="flex flex-wrap items-center gap-2">
+              <span className="text-base font-semibold leading-none tracking-tight text-foreground">
+                {title}
+              </span>
+              {connected && <ConnectedDot size="md" />}
+              {required && !connected && (
+                <StatusBadge label="Required" tone="required" size="md" />
+              )}
+              {badge && <StatusBadge label={badge} tone="muted" size="md" />}
+            </span>
+            {subtitle && (
+              <span className="text-sm leading-snug text-muted-foreground">
+                {subtitle}
+              </span>
+            )}
+          </span>
+        </div>
+        <IconChevronDown
+          size={18}
+          className={cn(
+            "mt-1 shrink-0 text-muted-foreground transition-transform",
+            open && "rotate-180",
+          )}
+        />
+      </button>
+      {open && (
+        <div className="border-t border-border/60 px-5 pb-5 pt-5 sm:px-6 sm:pb-6">
+          {children}
+        </div>
+      )}
+    </div>
+  );
+}
+
+function SidebarSettingsSection({
   id,
   icon,
   title,
@@ -42,21 +189,11 @@ export function SettingsSection({
           <span className="text-[12px] font-medium text-foreground truncate">
             {title}
           </span>
-          {connected && (
-            <span className="flex items-center justify-center shrink-0 rounded-full bg-green-500/15 text-green-500 w-4 h-4">
-              <IconCheck size={10} stroke={3} />
-            </span>
-          )}
+          {connected && <ConnectedDot size="sm" />}
           {required && !connected && (
-            <span className="shrink-0 rounded-full bg-accent/60 px-1.5 py-0.5 text-[9px] font-semibold uppercase tracking-wide text-muted-foreground">
-              Required
-            </span>
-          )}
-          {badge && (
-            <span className="shrink-0 rounded-full bg-accent/60 px-1.5 py-0.5 text-[9px] font-semibold uppercase tracking-wide text-muted-foreground">
-              {badge}
-            </span>
+            <StatusBadge label="Required" tone="muted" size="sm" />
           )}
+          {badge && <StatusBadge label={badge} tone="muted" size="sm" />}
         </div>
         <IconChevronDown
           size={12}

package/corpus/core/src/client/sse-event-processor.ts

@@ -15,6 +15,16 @@ import {
 
 export type ContentPart =
   | { type: "text"; text: string }
+  | {
+      /**
+       * Model chain-of-thought / extended-thinking prose. Streamed from
+       * server `thinking` SSE events (and code-agent thinking transcript
+       * items). Rendered as a collapsible plain-English cell — not a tool
+       * call.
+       */
+      type: "reasoning";
+      text: string;
+    }
   | {
       type: "tool-call";
       toolCallId: string;
@@ -669,7 +679,7 @@ function pendingToolNames(content: ContentPart[]): {
 
 function contentSnapshot(content: ContentPart[]): ContentPart[] {
   return content.map((part) => {
-    if (part.type === "text") return { ...part };
+    if (part.type === "text" || part.type === "reasoning") return { ...part };
     return {
       ...part,
       args: { ...part.args },
@@ -952,6 +962,23 @@ export function processEvent(
     };
   }
 
+  if (ev.type === "thinking") {
+    // Model chain-of-thought. Coalesce consecutive deltas into one reasoning
+    // part so the UI can render a single collapsible "Thinking" cell.
+    const delta = ev.text ?? "";
+    if (!delta) return { action: "continue" };
+    const lastPart = content[content.length - 1];
+    if (lastPart && lastPart.type === "reasoning") {
+      lastPart.text += delta;
+    } else {
+      content.push({ type: "reasoning", text: delta });
+    }
+    return {
+      action: "yield",
+      result: { content: contentSnapshot(content) } as ChatModelRunResult,
+    };
+  }
+
   if (ev.type === "stream_keepalive") {
     return { action: "continue" };
   }
@@ -1400,7 +1427,7 @@ function clearAssistantDraftContent(content: ContentPart[]): void {
   for (let index = content.length - 1; index >= 0; index--) {
     const part = content[index];
     if (!part) continue;
-    if (part.type === "text") {
+    if (part.type === "text" || part.type === "reasoning") {
       content.splice(index, 1);
       continue;
     }

package/corpus/core/src/extensions/actions.ts

@@ -3,6 +3,7 @@ import type { ActionRunContext } from "../action.js";
 import type { ActionEntry } from "../agent/production-agent.js";
 import type { AgentChatAttachment } from "../agent/types.js";
 import { writeAppState } from "../application-state/script-helpers.js";
+import { getRequestRunContext } from "../server/request-context.js";
 import { resolveAccess } from "../sharing/access.js";
 import type {
   ExtensionContentEdit,
@@ -38,6 +39,8 @@ import {
   unhideExtension,
   updateExtension,
   updateExtensionContent,
+  type ExtensionHistoryDetail,
+  type ExtensionHistoryEntry,
   type ExtensionRow,
 } from "./store.js";
 
@@ -126,7 +129,7 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
     "get-extension": {
       tool: {
         description:
-          "Get one existing extension by id. Use this when <current-screen> or <current-url> contains extensionId for the current extension; do not call list-extensions just to rediscover that id. Defaults to including the full Alpine.js content so you can make a targeted update-extension edit.",
+          "Get one existing extension by id. Use this when <current-screen> or <current-url> contains extensionId for the current extension; do not call list-extensions just to rediscover that id. Defaults to including the full Alpine.js content once per run so you can make a targeted update-extension edit; repeated unchanged reads return compact metadata unless forceContent=true.",
         parameters: {
           type: "object",
           properties: {
@@ -140,6 +143,11 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
               description:
                 "Include full Alpine.js content. Defaults to true for targeted edits.",
             },
+            forceContent: {
+              type: "boolean",
+              description:
+                "Return full content even if this run already read the same unchanged body. Use sparingly; prefer update-extension edits after the first read.",
+            },
           },
           required: ["id"],
         },
@@ -151,14 +159,16 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
           args?.includeContent === undefined
             ? true
             : coerceBoolean(args.includeContent);
+        const forceContent = coerceBoolean(args?.forceContent);
         const localExtension = await getLocalExtension(id);
         if (localExtension) {
           return {
             ok: true,
-            extension: await summarizeExtension(
+            extension: await summarizeExtensionForAgentRead(
               localExtension,
               new Set(),
               includeContent,
+              forceContent,
             ),
           };
         }
@@ -167,10 +177,11 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
         const hiddenIds = await getHiddenExtensionIdsForCurrentUser();
         return {
           ok: true,
-          extension: await summarizeExtension(
+          extension: await summarizeExtensionForAgentRead(
             extension,
             hiddenIds,
             includeContent,
+            forceContent,
           ),
         };
       },
@@ -223,7 +234,7 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
     "get-extension-history-version": {
       tool: {
         description:
-          "Get one extension history version with its previous-version diff. Use after list-extension-history when the user wants to inspect exactly what changed.",
+          "Get one extension history version with its previous-version diff. Use after list-extension-history when the user wants to inspect exactly what changed. Full HTML bodies are omitted by default; set includeContent=true only when restoring or manually comparing full source.",
         parameters: {
           type: "object",
           properties: {
@@ -235,6 +246,11 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
               type: "number",
               description: "History version number to inspect.",
             },
+            includeContent: {
+              type: "boolean",
+              description:
+                "Include full HTML for the current and previous versions. Defaults to false to keep agent context compact.",
+            },
           },
           required: ["id", "version"],
         },
@@ -252,7 +268,13 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
         if (!detail) {
           return `Error: extension history version not found: ${id}#${version}`;
         }
-        return { ok: true, ...detail };
+        return {
+          ok: true,
+          ...compactExtensionHistoryDetail(
+            detail,
+            coerceBoolean(args?.includeContent),
+          ),
+        };
       },
       readOnly: true,
     },
@@ -1059,11 +1081,97 @@ async function summarizeExtension(
     hiddenBy: row.hiddenBy,
     createdAt: row.createdAt,
     updatedAt: row.updatedAt,
+    contentLength: row.content.length,
+    contentHash: contentFingerprint(row.content),
     ...(local ? { source: row.source } : {}),
     ...(includeContent ? { content: row.content } : {}),
   };
 }
 
+async function summarizeExtensionForAgentRead(
+  row: ExtensionRow | LocalExtensionRow,
+  hiddenIds: Set<string>,
+  includeContent: boolean,
+  forceContent: boolean,
+) {
+  if (!includeContent) {
+    return summarizeExtension(row, hiddenIds, false);
+  }
+
+  const fingerprint = contentFingerprint(row.content);
+  const runCtx = getRequestRunContext();
+  const reads = runCtx ? (runCtx.extensionContentReads ??= {}) : undefined;
+  const alreadySent = !forceContent && reads?.[row.id] === fingerprint;
+  if (!alreadySent && reads) {
+    reads[row.id] = fingerprint;
+  }
+
+  const summary = await summarizeExtension(row, hiddenIds, !alreadySent);
+  if (!alreadySent) return summary;
+
+  return {
+    ...summary,
+    contentOmitted: {
+      reason: "unchanged-content-already-returned-this-run",
+      contentHash: fingerprint,
+      contentLength: row.content.length,
+      next: "Use the content already returned earlier in this run and call update-extension with focused edits/patches. Set forceContent=true only if you truly need the full body again.",
+    },
+  };
+}
+
+function compactExtensionHistoryDetail(
+  detail: ExtensionHistoryDetail,
+  includeContent: boolean,
+): ExtensionHistoryDetail & {
+  diffOmitted?: { omittedLines: number; maxLines: number };
+} {
+  const diffMaxLines = 400;
+  const fullDiff = detail.diff ?? [];
+  const diff =
+    fullDiff.length > diffMaxLines
+      ? [...fullDiff.slice(0, 200), ...fullDiff.slice(fullDiff.length - 200)]
+      : fullDiff;
+  return {
+    ...detail,
+    entry: compactHistoryEntry(detail.entry, includeContent),
+    previous: detail.previous
+      ? compactHistoryEntry(detail.previous, includeContent)
+      : null,
+    diff,
+    ...(fullDiff.length > diff.length
+      ? {
+          diffOmitted: {
+            omittedLines: fullDiff.length - diff.length,
+            maxLines: diffMaxLines,
+          },
+        }
+      : {}),
+  };
+}
+
+function compactHistoryEntry(
+  entry: ExtensionHistoryEntry,
+  includeContent: boolean,
+): ExtensionHistoryEntry & { contentHash?: string } {
+  const content = entry.content ?? "";
+  const withHash = {
+    ...entry,
+    ...(content ? { contentHash: contentFingerprint(content) } : {}),
+  };
+  if (includeContent) return withHash;
+  const { content: _content, ...withoutContent } = withHash;
+  return withoutContent;
+}
+
+function contentFingerprint(content: string): string {
+  let hash = 5381;
+  for (let i = 0; i < content.length; i++) {
+    hash = (hash * 33) ^ content.charCodeAt(i);
+  }
+  return `${content.length.toString(36)}-${(hash >>> 0).toString(36)}`;
+}
+
 async function localExtensionEditMessage(id: string): Promise<string | null> {
   const localExtension = await getLocalExtension(id);
   if (!localExtension) return null;

package/corpus/core/src/notifications/channels.ts

@@ -1,17 +1,22 @@
 /**
  * Built-in notification channels.
  *
- * Set environment variables to auto-register the webhook channel at startup.
+ * Webhook and Slack are always registered. Delivery uses (in order):
+ *   1. per-notification `metadata.webhookUrl` / `metadata.slackWebhookUrl`
+ *   2. the matching `NOTIFICATIONS_*` env URL (workspace default)
+ * If neither is set, that channel no-ops for the emission.
+ *
  * Extra channels can be registered at any time via
  * `registerNotificationChannel()` from a server plugin.
  *
- * NOTIFICATIONS_WEBHOOK_URL  → POST notifications as JSON to this URL.
+ * NOTIFICATIONS_WEBHOOK_URL  → default POST JSON URL when metadata omits one.
  *                              Supports `${keys.NAME}` substitution — the raw
  *                              value never enters the agent context.
  * NOTIFICATIONS_WEBHOOK_AUTH → optional `Authorization` header value (also
  *                              supports `${keys.NAME}`).
  * NOTIFICATIONS_SLACK_WEBHOOK_URL
- *                            → POST notifications to a Slack incoming webhook.
+ *                            → default Slack incoming webhook when metadata
+ *                              omits `slackWebhookUrl`.
  *                              Supports `${keys.NAME}` substitution.
  * NOTIFICATIONS_EMAIL_CHANNEL=1
  *                            → enable the built-in email channel for
@@ -30,7 +35,7 @@ import {
 } from "../secrets/substitution.js";
 import { sendEmail } from "../server/email.js";
 import { registerNotificationChannel } from "./registry.js";
-import type { NotificationChannel } from "./types.js";
+import type { NotificationChannel, NotificationInput } from "./types.js";
 
 let _registered = false;
 
@@ -38,30 +43,38 @@ export function registerBuiltinNotificationChannels(): void {
   if (_registered) return;
   _registered = true;
 
-  const url = process.env.NOTIFICATIONS_WEBHOOK_URL;
-  if (url) {
-    registerNotificationChannel(createWebhookChannel(url));
-  }
-
-  const slackUrl = process.env.NOTIFICATIONS_SLACK_WEBHOOK_URL;
-  if (slackUrl) {
-    registerNotificationChannel(createSlackWebhookChannel(slackUrl));
-  }
-
-  const emailRecipients = process.env.NOTIFICATIONS_EMAIL_RECIPIENTS?.trim();
-  if (process.env.NOTIFICATIONS_EMAIL_CHANNEL === "1" || emailRecipients) {
-    registerNotificationChannel(createEmailChannel());
-  }
+  registerNotificationChannel(
+    createWebhookChannel(process.env.NOTIFICATIONS_WEBHOOK_URL),
+  );
+  registerNotificationChannel(
+    createSlackWebhookChannel(process.env.NOTIFICATIONS_SLACK_WEBHOOK_URL),
+  );
+  // Email is always registered so per-notification `metadata.emailRecipients`
+  // work without a workspace-wide env flag (same pattern as webhook/slack).
+  registerNotificationChannel(createEmailChannel());
 }
 
-function createWebhookChannel(urlTemplate: string): NotificationChannel {
+function createWebhookChannel(
+  envUrlTemplate: string | undefined,
+): NotificationChannel {
   const authTemplate = process.env.NOTIFICATIONS_WEBHOOK_AUTH;
   return {
     name: "webhook",
     async deliver(input, meta) {
+      const overrideUrlTemplate = deliveryMetadataString(
+        input.metadata,
+        "webhookUrl",
+      );
+      const urlTemplate =
+        overrideUrlTemplate ??
+        metadataString(input.metadata, "webhookUrl") ??
+        envUrlTemplate?.trim();
+      // No-op when neither a per-notification nor workspace URL is set —
+      // mirrors email's empty-recipients behavior so notify-all stays quiet.
+      if (!urlTemplate) return false;
       const { url, headers } = await resolveWebhookRequest(
         urlTemplate,
-        authTemplate,
+        overrideUrlTemplate ? undefined : authTemplate,
         meta.owner,
         "webhook",
       );
@@ -74,7 +87,7 @@ function createWebhookChannel(urlTemplate: string): NotificationChannel {
             severity: input.severity,
             title: input.title,
             body: input.body,
-            metadata: input.metadata,
+            metadata: scrubDeliveryMetadata(input.metadata),
             owner: meta.owner,
             emittedAt: new Date().toISOString(),
           }),
@@ -92,14 +105,25 @@ function createWebhookChannel(urlTemplate: string): NotificationChannel {
   };
 }
 
-function createSlackWebhookChannel(urlTemplate: string): NotificationChannel {
+function createSlackWebhookChannel(
+  envUrlTemplate: string | undefined,
+): NotificationChannel {
   const authTemplate = process.env.NOTIFICATIONS_SLACK_WEBHOOK_AUTH;
   return {
     name: "slack",
     async deliver(input, meta) {
+      const overrideUrlTemplate = deliveryMetadataString(
+        input.metadata,
+        "slackWebhookUrl",
+      );
+      const urlTemplate =
+        overrideUrlTemplate ??
+        metadataString(input.metadata, "slackWebhookUrl") ??
+        envUrlTemplate?.trim();
+      if (!urlTemplate) return false;
       const { url, headers } = await resolveWebhookRequest(
         urlTemplate,
-        authTemplate,
+        overrideUrlTemplate ? undefined : authTemplate,
         meta.owner,
         "Slack webhook",
       );
@@ -159,7 +183,7 @@ function createEmailChannel(): NotificationChannel {
     name: "email",
     async deliver(input) {
       const recipients = notificationEmailRecipients(input.metadata);
-      if (recipients.length === 0) return;
+      if (recipients.length === 0) return false;
       const subject =
         typeof input.metadata?.emailSubject === "string" &&
         input.metadata.emailSubject.trim()
@@ -240,6 +264,41 @@ async function resolveWebhookRequest(
   return { url, headers };
 }
 
+function metadataString(
+  metadata: NotificationInput["metadata"],
+  key: string,
+): string | undefined {
+  const value = metadata?.[key];
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed || undefined;
+}
+
+function deliveryMetadataString(
+  metadata: NotificationInput["metadata"],
+  key: string,
+): string | undefined {
+  const delivery = metadata?.delivery;
+  if (!delivery || typeof delivery !== "object" || Array.isArray(delivery)) {
+    return undefined;
+  }
+  const value = (delivery as Record<string, unknown>)[key];
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed || undefined;
+}
+
+function scrubDeliveryMetadata(
+  metadata: Record<string, unknown> | undefined,
+): Record<string, unknown> | undefined {
+  if (!metadata) return undefined;
+  const entries = Object.entries(metadata).filter(
+    ([key]) =>
+      key !== "delivery" && key !== "webhookUrl" && key !== "slackWebhookUrl",
+  );
+  return entries.length ? Object.fromEntries(entries) : undefined;
+}
+
 function notificationEmailRecipients(
   metadata: Record<string, unknown> | undefined,
 ): string[] {
@@ -275,7 +334,11 @@ function scrubEmailMetadata(
 ): Record<string, unknown> | null {
   if (!metadata) return null;
   const entries = Object.entries(metadata).filter(
-    ([key]) => key !== "emailRecipients" && key !== "emailSubject",
+    ([key]) =>
+      key !== "emailRecipients" &&
+      key !== "emailSubject" &&
+      key !== "webhookUrl" &&
+      key !== "slackWebhookUrl",
   );
   return entries.length ? Object.fromEntries(entries) : null;
 }

package/corpus/core/src/notifications/registry.ts

@@ -105,6 +105,7 @@ export async function notifyWithDelivery(
     body: truncate(input.body, MAX_BODY_LEN),
   };
   const channels = selectChannels(input.channels);
+  const storedMetadata = scrubStoredMetadata(input.metadata);
 
   // The inbox channel is always included unless explicitly excluded.
   const runInbox = !input.channels || input.channels.includes("inbox");
@@ -120,7 +121,7 @@ export async function notifyWithDelivery(
         severity: input.severity,
         title: input.title,
         body: input.body,
-        metadata: input.metadata,
+        metadata: storedMetadata,
         deliveredChannels: ["inbox"],
       });
       delivered.push("inbox");
@@ -132,13 +133,15 @@ export async function notifyWithDelivery(
   // Await every channel so a 500-ing webhook doesn't end up in `delivered`.
   const results = await Promise.allSettled(
     channels.map(async (channel) => {
-      await channel.deliver(input, meta);
+      const delivered = await channel.deliver(input, meta);
+      // Explicit `false` means the channel skipped (no URL / recipients).
+      if (delivered === false) return null;
       return channel.name;
     }),
   );
   results.forEach((r, i) => {
     if (r.status === "fulfilled") {
-      delivered.push(r.value);
+      if (r.value) delivered.push(r.value);
     } else {
       console.error(
         `[notifications] channel "${channels[i].name}" failed:`,
@@ -181,6 +184,17 @@ export async function notifyWithDelivery(
   return { notification: stored, deliveredChannels: delivered };
 }
 
+function scrubStoredMetadata(
+  metadata: Record<string, unknown> | undefined,
+): Record<string, unknown> | undefined {
+  if (!metadata) return undefined;
+  const entries = Object.entries(metadata).filter(
+    ([key]) =>
+      key !== "delivery" && key !== "webhookUrl" && key !== "slackWebhookUrl",
+  );
+  return entries.length ? Object.fromEntries(entries) : undefined;
+}
+
 function selectChannels(allowlist?: string[]): NotificationChannel[] {
   const registry = getRegistry();
   const all = Array.from(registry.values());