@agent-native/core 0.95.0 → 0.96.0

package/corpus/core/src/localization/default-messages.ts

@@ -216,6 +216,12 @@ const messages = {
       promptTitle: "Talk to your app",
       promptDescription:
         "Voice mode keeps listening while the agent navigates and takes actions.",
+      setupTitle: "Set up voice mode",
+      setupDescription:
+        "Connect Builder to use managed voice with credits, or use your own OpenAI API key.",
+      connectBuilder: "Connect Builder",
+      useOpenAiKey: "Use OpenAI API key",
+      startWithOpenAiKey: "Start with OpenAI key",
       start: "Start voice mode",
       keepDictating: "Keep dictating",
       showChat: "Show chat",

package/corpus/core/src/observability/hosted-model-experiment.ts

@@ -0,0 +1,118 @@
+export const HOSTED_DEFAULT_MODEL_EXPERIMENT_ID =
+  "hosted-default-model-sonnet-5-vs-gpt-5-6-luna-2026-07";
+
+export const HOSTED_DEFAULT_MODEL_CONTROL = {
+  id: "sonnet-5",
+  model: "claude-sonnet-5",
+  weight: 80,
+} as const;
+
+export const HOSTED_DEFAULT_MODEL_TREATMENT = {
+  id: "gpt-5-6-luna",
+  model: "gpt-5-6-luna",
+  weight: 20,
+} as const;
+
+export interface HostedDefaultModelExperimentAssignment {
+  experimentId: string;
+  variantId: string;
+}
+
+export interface HostedDefaultModelExperimentResolution {
+  model: string;
+  assignment: HostedDefaultModelExperimentAssignment;
+}
+
+type HostedExperimentEnv = Record<string, string | undefined>;
+
+const FIRST_PARTY_HOST_SUFFIX = ".agent-native.com";
+const ENABLED_VALUES = new Set(["1", "true", "on", "yes"]);
+const DISABLED_VALUES = new Set(["0", "false", "off", "no"]);
+
+function hostnameFromUrl(value: string | undefined): string | null {
+  const trimmed = value?.trim();
+  if (!trimmed) return null;
+  try {
+    const url = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed)
+      ? new URL(trimmed)
+      : new URL(`https://${trimmed}`);
+    return url.hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The rollout is automatic only on first-party hosted app domains. Operators
+ * can explicitly enable or disable it for preview and emergency rollback.
+ */
+export function isHostedDefaultModelExperimentEnabled(
+  env: HostedExperimentEnv = process.env,
+): boolean {
+  const override =
+    env.AGENT_NATIVE_HOSTED_MODEL_EXPERIMENT?.trim().toLowerCase();
+  if (override && DISABLED_VALUES.has(override)) return false;
+  if (override && ENABLED_VALUES.has(override)) return true;
+
+  const hostnames = [
+    env.APP_URL,
+    env.BETTER_AUTH_URL,
+    env.URL,
+    env.DEPLOY_URL,
+    env.VERCEL_PROJECT_PRODUCTION_URL,
+    env.VERCEL_URL,
+  ]
+    .map(hostnameFromUrl)
+    .filter((hostname): hostname is string => Boolean(hostname));
+
+  return hostnames.some(
+    (hostname) =>
+      hostname === "agent-native.com" ||
+      hostname.endsWith(FIRST_PARTY_HOST_SUFFIX),
+  );
+}
+
+/**
+ * Stable cross-app bucket: the same authenticated user receives the same
+ * variant in every hosted template for the life of this experiment id.
+ */
+export function hostedDefaultModelExperimentBucket(userId: string): number {
+  const input = `${HOSTED_DEFAULT_MODEL_EXPERIMENT_ID}:${userId.trim().toLowerCase()}`;
+  let hash = 0x811c9dc5;
+  for (let index = 0; index < input.length; index++) {
+    hash ^= input.charCodeAt(index);
+    hash = Math.imul(hash, 0x01000193);
+  }
+  return (hash >>> 0) % 100;
+}
+
+export function resolveHostedDefaultModelExperiment(args: {
+  userId: string | null | undefined;
+  engineName: string;
+  isDefaultModelSelection: boolean;
+  supportedModels?: readonly string[];
+  env?: HostedExperimentEnv;
+}): HostedDefaultModelExperimentResolution | null {
+  const userId = args.userId?.trim();
+  if (!userId) return null;
+  if (args.engineName !== "builder") return null;
+  if (!args.isDefaultModelSelection) return null;
+  if (!isHostedDefaultModelExperimentEnabled(args.env)) return null;
+
+  const variant =
+    hostedDefaultModelExperimentBucket(userId) <
+    HOSTED_DEFAULT_MODEL_TREATMENT.weight
+      ? HOSTED_DEFAULT_MODEL_TREATMENT
+      : HOSTED_DEFAULT_MODEL_CONTROL;
+  if (args.supportedModels && !args.supportedModels.includes(variant.model)) {
+    return null;
+  }
+
+  return {
+    model: variant.model,
+    assignment: {
+      experimentId: HOSTED_DEFAULT_MODEL_EXPERIMENT_ID,
+      variantId: variant.id,
+    },
+  };
+}

package/corpus/core/src/observability/routes.ts

@@ -69,6 +69,18 @@ async function resolveOwner(event: H3Event): Promise<string> {
   return session.email;
 }
 
+function canManageExperiments(ownerEmail: string): boolean {
+  // Local development keeps the built-in dashboard usable without additional
+  // setup. Hosted deployments fail closed unless the operator supplies an
+  // explicit allowlist, because experiments affect every user in the app.
+  if (process.env.NODE_ENV !== "production") return true;
+  const admins = (process.env.AGENT_NATIVE_EXPERIMENT_ADMIN_EMAILS ?? "")
+    .split(",")
+    .map((email) => email.trim().toLowerCase())
+    .filter(Boolean);
+  return admins.includes(ownerEmail.trim().toLowerCase());
+}
+
 function parseSince(q: Record<string, any>): number {
   const raw = q.since;
   if (typeof raw === "string" && raw.length > 0) {
@@ -236,6 +248,11 @@ export function createObservabilityHandler() {
       return getEvalStats(parseSince(q), { userId: owner });
     }
 
+    if (parts[0] === "experiments" && !canManageExperiments(owner)) {
+      setResponseStatus(event, 403);
+      return { error: "Experiment administrator access required" };
+    }
+
     // POST /experiments — create experiment. Records the calling user as
     // the owner so subsequent PUT / POST results require the same caller.
     if (method === "POST" && parts.length === 1 && parts[0] === "experiments") {

package/corpus/core/src/observability/store.ts

@@ -972,7 +972,10 @@ export async function updateExperiment(
     sets.push("status = ?");
     args.push(updates.status);
     if (updates.status === "running" && !updates.endedAt) {
-      sets.push("started_at = ?");
+      // Preserve the original exposure window when a paused experiment
+      // resumes; resetting it would silently discard the first run period from
+      // the results.
+      sets.push("started_at = COALESCE(started_at, ?)");
       args.push(Date.now());
     }
   }

package/corpus/core/src/observability/traces.ts

@@ -100,6 +100,11 @@ function emitLlmGenerationTrackingEvent(args: {
   successfulTools: number;
   failedTools: number;
   createdAt: number;
+  experimentAssignments?: Array<{
+    experimentId: string;
+    variantId: string;
+  }>;
+  modelSelectionSource?: string;
 }): void {
   const provider = llmProviderFromEngine(args.engineName, args.model);
   const costUsd = costUsdFromCenticents(args.costCentsX100);
@@ -126,6 +131,7 @@ function emitLlmGenerationTrackingEvent(args: {
     tool_calls: args.toolCalls,
     successful_tools: args.successfulTools,
     failed_tools: args.failedTools,
+    model_selection_source: args.modelSelectionSource,
     created_at: new Date(args.createdAt).toISOString(),
     created_at_ms: args.createdAt,
     $ai_trace_id: args.runId,
@@ -145,6 +151,18 @@ function emitLlmGenerationTrackingEvent(args: {
     $ai_request_count: 1,
     $ai_total_cost_usd: costUsd,
   };
+  if (args.experimentAssignments?.length) {
+    properties.experiment_ids = args.experimentAssignments
+      .map((assignment) => assignment.experimentId)
+      .join(",");
+    properties.experiment_variants = args.experimentAssignments
+      .map((assignment) => assignment.variantId)
+      .join(",");
+    if (args.experimentAssignments.length === 1) {
+      properties.experiment_id = args.experimentAssignments[0].experimentId;
+      properties.experiment_variant = args.experimentAssignments[0].variantId;
+    }
+  }
   if (error) properties.error_message = error;
 
   for (const key of Object.keys(properties)) {
@@ -245,6 +263,12 @@ export async function instrumentAgentLoop(opts: {
    *  reads. */
   userId: string | null;
   config: ObservabilityConfig;
+  metadata?: Record<string, unknown> | null;
+  experimentAssignments?: Array<{
+    experimentId: string;
+    variantId: string;
+  }>;
+  modelSelectionSource?: string;
   classifyError?: (error: unknown) =>
     | {
         status?: "success" | "error";
@@ -268,6 +292,15 @@ export async function instrumentAgentLoop(opts: {
     "agent.thread_id": threadId ?? undefined,
     "agent.user_id": userId ?? undefined,
     "agent.model": loopOpts.model,
+    "agent.model_selection_source": opts.modelSelectionSource,
+    "agent.experiment_id":
+      opts.experimentAssignments?.length === 1
+        ? opts.experimentAssignments[0].experimentId
+        : undefined,
+    "agent.experiment_variant":
+      opts.experimentAssignments?.length === 1
+        ? opts.experimentAssignments[0].variantId
+        : undefined,
   });
 
   const spans: TraceSpan[] = [];
@@ -424,7 +457,7 @@ export async function instrumentAgentLoop(opts: {
   let usage: AgentLoopUsage | undefined;
   let runStatus: "success" | "error" = "success";
   let errorMessage: string | null = null;
-  let runMetadata: Record<string, unknown> | null = null;
+  let runMetadata: Record<string, unknown> | null = opts.metadata ?? null;
   try {
     usage = await runAgentLoop({ ...loopOpts, send: instrumentedSend });
   } catch (err: any) {
@@ -434,7 +467,11 @@ export async function instrumentAgentLoop(opts: {
       classification?.errorMessage === undefined
         ? (err?.message ?? String(err))
         : classification.errorMessage;
-    runMetadata = classification?.metadata ?? null;
+    const errorMetadata = classification?.metadata ?? null;
+    runMetadata =
+      runMetadata || errorMetadata
+        ? { ...(runMetadata ?? {}), ...(errorMetadata ?? {}) }
+        : null;
     throw err;
   } finally {
     const runEnd = Date.now();
@@ -501,6 +538,8 @@ export async function instrumentAgentLoop(opts: {
         successfulTools,
         failedTools,
         createdAt: runStart,
+        experimentAssignments: opts.experimentAssignments,
+        modelSelectionSource: opts.modelSelectionSource,
       });
     }
 

package/corpus/core/src/scripts/agent-engines/list-agent-engines.ts

@@ -15,6 +15,8 @@ import {
   normalizeModelForEngine,
 } from "../../agent/engine/index.js";
 import type { ActionTool } from "../../agent/types.js";
+import { resolveHostedDefaultModelExperiment } from "../../observability/hosted-model-experiment.js";
+import { getRequestUserEmail } from "../../server/request-context.js";
 import { getSetting } from "../../settings/index.js";
 
 export const tool: ActionTool = {
@@ -82,13 +84,23 @@ export async function run(args: Record<string, string> = {}): Promise<string> {
         ? current?.model
         : undefined;
   const currentEngineName = currentEntry?.name ?? "anthropic";
-  const currentModel =
+  let currentModel =
     currentEntry && !envUnavailable
       ? normalizeModelForEngine(
           currentEntry,
           currentModelCandidate ?? currentEntry.defaultModel,
         )
       : (currentModelCandidate ?? DEFAULT_MODEL);
+  const hostedExperiment =
+    currentEntry && !currentModelCandidate
+      ? resolveHostedDefaultModelExperiment({
+          userId: getRequestUserEmail(),
+          engineName: currentEntry.name,
+          isDefaultModelSelection: true,
+          supportedModels: currentEntry.supportedModels,
+        })
+      : null;
+  if (hostedExperiment) currentModel = hostedExperiment.model;
 
   const result = {
     engines: engines.map((e) => ({
@@ -107,6 +119,12 @@ export async function run(args: Record<string, string> = {}): Promise<string> {
       : {
           engine: currentEngineName,
           model: currentModel,
+          ...(hostedExperiment
+            ? {
+                modelSelectionSource: "experiment",
+                experimentAssignment: hostedExperiment.assignment,
+              }
+            : {}),
         },
   };
 

package/corpus/core/src/scripts/call-agent.ts

@@ -321,7 +321,14 @@ export async function run(
           orgDomain: callerOrgDomain,
           orgSecret: callerOrgSecret,
           onUpdate: onRemotePollUpdate,
-          ...(callTimeoutMs ? { timeoutMs: callTimeoutMs } : {}),
+          ...(callTimeoutMs
+            ? {
+                timeoutMs: callTimeoutMs,
+                // Integration callers must keep the timeout task id so the
+                // catch below can enqueue durable continuation polling.
+                returnRecoverableArtifactsOnTimeout: false,
+              }
+            : {}),
         });
         responseText =
           formatDownstreamLlmCredentialFailure(agent.name, responseText) ??
@@ -348,8 +355,23 @@ export async function run(
               `The ${agent.name} agent accepted this delegated subtask and will post its own final result to the originating integration thread automatically. ` +
               `Do not call ${agent.name} again for this same subtask. Continue any other requested work, then answer with the completed results you have; if needed, mention that ${agent.name} is posting its result separately.`;
           } else {
-            const reason = pollErr?.message ?? "unknown error";
-            responseText = `The ${agent.name} agent is taking longer than expected and didn't reply in time. (${reason})`;
+            // The normal integration path must preserve the timeout task id so
+            // it can enqueue a durable continuation. If that enqueue fails,
+            // do not hide receiver-verified artifacts that were already
+            // returned with the last poll; this mirrors callAgent's default
+            // timeout behavior without treating arbitrary remote status text
+            // as a completed response.
+            const recoverableArtifactText =
+              extractRecoverableTimeoutArtifactText(pollErr);
+            if (recoverableArtifactText) {
+              responseText = expandRelativeUrls(
+                recoverableArtifactText,
+                agent.url,
+              );
+            } else {
+              const reason = pollErr?.message ?? "unknown error";
+              responseText = `The ${agent.name} agent is taking longer than expected and didn't reply in time. (${reason})`;
+            }
           }
         } else {
           const reason = pollErr?.message ?? "unknown error";
@@ -490,6 +512,34 @@ function getA2ATaskTimeoutTaskId(err: unknown): string | null {
   return match?.[1] ?? null;
 }
 
+/**
+ * Mirrors the A2A client's default timeout recovery for the exceptional case
+ * where an integration cannot enqueue a durable continuation. Only an
+ * explicitly receiver-marked task message is safe to surface as a completed
+ * partial result; ordinary working-state text remains a timeout failure.
+ */
+function extractRecoverableTimeoutArtifactText(err: unknown): string {
+  const candidate = err as
+    | { lastTask?: Task | unknown; name?: unknown }
+    | null
+    | undefined;
+  const lastTask =
+    err instanceof A2ATaskTimeoutError
+      ? err.lastTask
+      : candidate?.name === "A2ATaskTimeoutError"
+        ? (candidate.lastTask as Task | undefined)
+        : undefined;
+  const message = lastTask?.status?.message;
+  if (!message?.metadata?.agentNativeRecoverableArtifacts) return "";
+
+  return message.parts
+    .filter(
+      (part): part is { type: "text"; text: string } => part.type === "text",
+    )
+    .map((part) => part.text)
+    .join("\n");
+}
+
 async function formatExistingIntegrationContinuationIfRetry(
   agent: {
     name: string;

package/corpus/core/src/scripts/chat/search-chats.ts

@@ -4,7 +4,7 @@
  * Search or list past agent chat threads.
  *
  * Usage:
- *   pnpm action search-chats [--query "search term"] [--limit N] [--format json]
+ *   pnpm action search-chats [--query "search term"] [--limit N] [--format json] [--includeArchived]
  */
 
 import { searchThreads, listThreads } from "../../chat-threads/store.js";
@@ -40,15 +40,17 @@ export default async function searchChats(args: string[]): Promise<void> {
     console.log(`Usage: pnpm action search-chats [options]
 
 Options:
-  --query <text>  Search chats by title, preview, or content
-  --limit N       Max results (default: 20)
-  --format json   Output as JSON
-  --help          Show this help message
+  --query <text>       Search chats by title, preview, or content
+  --limit N            Max results (default: 20)
+  --format json        Output as JSON
+  --includeArchived    Also include archived chats (excluded by default)
+  --help               Show this help message
 
 Examples:
   pnpm action search-chats --query "email setup"
   pnpm action search-chats --limit 5
-  pnpm action search-chats --format json`);
+  pnpm action search-chats --format json
+  pnpm action search-chats --includeArchived`);
     return;
   }
 
@@ -56,10 +58,11 @@ Examples:
   const limit = parsed.limit ? parseInt(parsed.limit, 10) : 20;
   if (isNaN(limit) || limit < 1) fail("--limit must be a positive integer");
 
+  const includeArchived = parsed.includeArchived === "true";
   const query = parsed.query;
   const threads = query
-    ? await searchThreads(owner, query, limit)
-    : await listThreads(owner, limit, 0);
+    ? await searchThreads(owner, query, limit, { includeArchived })
+    : await listThreads(owner, { limit, offset: 0, includeArchived });
 
   if (parsed.format === "json") {
     console.log(

package/corpus/core/src/secrets/register-framework-secrets.ts

@@ -22,7 +22,7 @@ export function registerFrameworkSecrets(): void {
       key: "OPENAI_API_KEY",
       label: "OpenAI API key",
       description:
-        "Enables realtime voice conversations with your app and optional OpenAI transcription.",
+        "Optional fallback for realtime voice when Builder is not connected, and for OpenAI transcription.",
       docsUrl: "https://platform.openai.com/api-keys",
       scope: "user",
       kind: "api-key",

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -54,11 +54,16 @@ import {
   listAgentEngines,
   registerBuiltinEngines,
 } from "../agent/engine/index.js";
-import type { AgentEngine, EngineMessage } from "../agent/engine/types.js";
+import type {
+  AgentEngine,
+  EngineMessage,
+  EngineTool,
+} from "../agent/engine/types.js";
 import {
   createProductionAgentHandler,
   actionsToEngineTools,
   executeAgentToolCall,
+  filterInitialEngineTools,
   getActiveRunForThreadAsync,
   abortRunDurably,
   subscribeToRun,
@@ -1903,6 +1908,11 @@ async function createChatScriptEntries(): Promise<Record<string, ActionEntry>> {
               description: "Output format",
               enum: ["json", "text"],
             },
+            includeArchived: {
+              type: "boolean",
+              description:
+                "Also include archived chats in the results. Archived chats are excluded by default.",
+            },
           },
         },
       },
@@ -1953,6 +1963,11 @@ async function createChatScriptEntries(): Promise<Record<string, ActionEntry>> {
                 description: "(search) Output format",
                 enum: ["json", "text"],
               },
+              includeArchived: {
+                type: "boolean",
+                description:
+                  "(search) Also include archived chats in the results. Archived chats are excluded by default, matching the 'archive' action's effect on the chat list.",
+              },
               id: {
                 type: "string",
                 description:
@@ -2940,6 +2955,22 @@ export function runA2AAgentLoop(
   );
 }
 
+/**
+ * Keep delegated A2A turns on the same compact initial tool surface as
+ * interactive chat. `tool-search` remains in the initial set, while the
+ * complete registry is supplied separately so the run loop can load a matched
+ * schema after a tool-search result.
+ */
+export function createA2AEngineToolSurface(
+  availableTools: EngineTool[],
+  initialToolNames?: string[],
+): { tools: EngineTool[]; availableTools: EngineTool[] } {
+  return {
+    tools: filterInitialEngineTools(availableTools, initialToolNames),
+    availableTools,
+  };
+}
+
 /**
  * Verbose framework sections returned by the `get-framework-context` tool.
  * Keyed by topic so the agent can request specific sections.
@@ -2971,9 +3002,9 @@ Use for charts, visualizations, previews. Don't use for simple text/tables or ex
   "chat-history": `### Chat History
 
 You can search and restore previous chat conversations using \`chat-history\`:
-- \`chat-history\` (action: "search") — Search or list past chat threads by keyword
+- \`chat-history\` (action: "search") — Search or list past chat threads by keyword. Archived threads are excluded by default; pass \`includeArchived: true\` to also see them.
 - \`chat-history\` (action: "open") — Open a chat thread in the UI as a new tab and focus it
-- \`chat-history\` (actions: "rename", "pin", "unpin", "archive") — Organize a known chat thread by ID
+- \`chat-history\` (actions: "rename", "pin", "unpin", "archive") — Organize a known chat thread by ID. Archiving a thread hides it from the default chat list and search.
 
 When the user asks to find a previous conversation, use \`chat-history\` with action "search" first to find matching threads, then action "open" to restore the one they want.`,
 
@@ -5077,7 +5108,10 @@ export function createAgentChatPlugin(
                 },
           );
 
-          const a2aTools = actionsToEngineTools(a2aActions);
+          const a2aToolSurface = createA2AEngineToolSurface(
+            actionsToEngineTools(a2aActions),
+            options?.initialToolNames,
+          );
 
           // Precise current time rides the user message (not the cached
           // system-prompt prefix) — same pattern as the interactive handler.
@@ -5098,7 +5132,7 @@ export function createAgentChatPlugin(
           const controller = new AbortController();
 
           console.log(
-            `[A2A] Starting agent loop: ${a2aTools.length} tools, prompt ${systemPrompt.length} chars`,
+            `[A2A] Starting agent loop: ${a2aToolSurface.tools.length}/${a2aToolSurface.availableTools.length} initial tools, prompt ${systemPrompt.length} chars`,
           );
 
           await runA2AAgentLoop(
@@ -5106,7 +5140,8 @@ export function createAgentChatPlugin(
               engine: a2aEngine,
               model,
               systemPrompt,
-              tools: a2aTools,
+              tools: a2aToolSurface.tools,
+              availableTools: a2aToolSurface.availableTools,
               messages: a2aMessages,
               actions: a2aActions,
               send: (event) => {

package/corpus/core/src/server/auth.ts

@@ -1627,7 +1627,7 @@ function loginHtmlResponse(loginHtml: string, event: H3Event): Response {
     headers: {
       "Content-Type": "text/html; charset=utf-8",
       // The sign-in document is part of the public server shell. Keep it on the
-      // same short-fresh/long-SWR CDN policy as React Router SSR so hosted
+      // same long-fresh/long-SWR CDN policy as React Router SSR so hosted
       // template roots do not invoke origin just to render anonymous login UI.
       // The login HTML is env-INDEPENDENT (a Google-only app always renders a
       // working button), so a cached copy is never "wrong" — never downgrade

package/corpus/core/src/server/core-routes-plugin.ts

@@ -298,6 +298,7 @@ const BUILDER_WAITLIST_USE_CASES = new Set([
   BUILDER_WAITLIST_DEFAULT_USE_CASE,
   "design_publish_app",
   "docs_build_online_waitlist",
+  "docs_edit_online_waitlist",
 ]);
 const BUILDER_WAITLIST_FORM_TIMEOUT_MS = 8000;
 const BUILDER_WAITLIST_TEXT_LIMIT = 4000;
@@ -320,6 +321,7 @@ export interface BuilderWaitlistBody {
   appUrl?: unknown;
   pageUrl?: unknown;
   source?: unknown;
+  template?: unknown;
   useCase?: unknown;
 }
 
@@ -352,6 +354,13 @@ function normalizeBuilderWaitlistUseCase(value: unknown): string {
     : BUILDER_WAITLIST_DEFAULT_USE_CASE;
 }
 
+function normalizeBuilderWaitlistTemplate(value: unknown): string | undefined {
+  const template = cleanBuilderWaitlistText(value, 100);
+  return template && /^[a-z0-9][a-z0-9-]{0,99}$/.test(template)
+    ? template
+    : undefined;
+}
+
 function isValidWaitlistEmail(email: string): boolean {
   return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
 }
@@ -506,6 +515,7 @@ export function buildBuilderWaitlistFormPayload(
     getOrigin(event);
   const source =
     cleanBuilderWaitlistText(body.source, 100) ?? BUILDER_WAITLIST_FORM_SOURCE;
+  const template = normalizeBuilderWaitlistTemplate(body.template);
   const useCase = normalizeBuilderWaitlistUseCase(body.useCase);
 
   return {
@@ -515,6 +525,7 @@ export function buildBuilderWaitlistFormPayload(
       appUrl,
       prompt: cleanBuilderWaitlistText(body.prompt),
       source,
+      template,
       useCase,
     },
     _hp: "",
@@ -522,6 +533,7 @@ export function buildBuilderWaitlistFormPayload(
       submitterEmail: sessionEmail,
       pageUrl: appUrl,
       source,
+      template,
       useCase,
     },
   };
@@ -2021,6 +2033,7 @@ export function createCoreRoutesPlugin(
             body,
           );
           const waitlistSource = waitlistPayload.data.source;
+          const waitlistTemplate = waitlistPayload.data.template;
           const waitlistUseCase = waitlistPayload.data.useCase;
           let formSubmission: { submitted: boolean; formId?: string };
           try {
@@ -2039,6 +2052,7 @@ export function createCoreRoutesPlugin(
                   err instanceof Error ? err.message : "unknown_waitlist_error",
                 source: waitlistSource,
                 stage: "waitlist",
+                template: waitlistTemplate ?? null,
                 useCase: waitlistUseCase,
               },
             );
@@ -2057,6 +2071,7 @@ export function createCoreRoutesPlugin(
               formSubmitted: formSubmission.submitted,
               source: waitlistSource,
               stage: "waitlist",
+              template: waitlistTemplate ?? null,
               useCase: waitlistUseCase,
             },
           );

package/corpus/core/src/server/credential-provider.ts

@@ -78,6 +78,8 @@ const APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS = new Set([
   "OPENAI_API_KEY",
   "OPENAI_BASE_URL",
   "OPENROUTER_API_KEY",
+  "GOOGLE_CLIENT_ID",
+  "GOOGLE_CLIENT_SECRET",
   "GOOGLE_GENERATIVE_AI_API_KEY",
   "GROQ_API_KEY",
   "MISTRAL_API_KEY",
@@ -93,9 +95,11 @@ function isAppProvidedDeployCredentialKey(key: string | undefined): boolean {
  * single-tenant contexts. In hosted production with a shared database, every
  * signed-in user needs their own user/org/workspace credential for
  * identity-bearing provider keys so one deploy key does not silently
- * impersonate another tenant. App-provided LLM provider keys are different:
- * they intentionally let the app developer pay for model usage for users of
- * that deployed app, so key-aware callers may use those env vars.
+ * impersonate another tenant. App-provided service credentials are different:
+ * they configure the deployed app itself rather than identifying a user. This
+ * includes LLM keys that let the app developer pay for model usage and OAuth
+ * client credentials whose per-user identity remains in scoped OAuth tokens.
+ * Key-aware callers may use those env vars.
  *
  * @deprecated Use `canUseDeployCredentialFallbackForRequest()` for generic
  * provider secrets. This stricter helper remains for legacy call sites with