@agent-native/core 0.95.1 → 0.97.0

package/corpus/core/src/org/accept-pending.ts

@@ -63,8 +63,16 @@ export async function acceptPendingInvitationsForEmail(
     });
     if (existing.rows.length === 0) {
       const role = inv.role === "admin" ? "admin" : "member";
+      // The SELECT above is a cheap pre-check, not a correctness guard —
+      // two concurrent acceptances (e.g. a retried signup hook) can both
+      // pass it before either INSERT commits. `ON CONFLICT (org_id,
+      // LOWER(email)) DO NOTHING` targets the unique expression index
+      // added in migrations.ts (org-members-unique-lower-email-idx) so the
+      // race's loser is a silent no-op instead of a thrown unique
+      // constraint violation or a duplicate row.
       await db.execute({
-        sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
+        sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)
+              ON CONFLICT (org_id, LOWER(email)) DO NOTHING`,
         args: [nanoid(), inv.orgId, email, role, Date.now()],
       });
     }

package/corpus/core/src/org/migrations.ts

@@ -61,4 +61,45 @@ export const ORG_MIGRATIONS = [
     version: 1008,
     sql: `CREATE INDEX IF NOT EXISTS organizations_lower_allowed_domain_idx ON organizations (LOWER(allowed_domain))`,
   },
+  {
+    // De-dup pass ahead of the unique index below. `org_members` has always
+    // had a `UNIQUE(org_id, email)` constraint (see v1002), but that's an
+    // exact-string match — callers that insert a session's raw-case email
+    // (e.g. handlers.ts's acceptInvitationHandler) can still create a
+    // second row for the same person under a different case, and every
+    // membership *read* in this module already matches case-insensitively
+    // via `LOWER(email)`. This keeps exactly one row per (org_id,
+    // LOWER(email)) — the row with the oldest `joined_at` (ties broken by
+    // `id` for determinism) — by deleting any row for which a strictly
+    // "older" row exists in the same group. Portable across SQLite and
+    // Postgres (plain correlated EXISTS subquery, no window functions).
+    // Must run before the unique index below or that CREATE would fail on
+    // any database that already has case-variant duplicates.
+    version: 1009,
+    name: "org-members-dedupe-lower-email",
+    sql: `DELETE FROM org_members
+      WHERE EXISTS (
+        SELECT 1 FROM org_members older
+        WHERE older.org_id = org_members.org_id
+          AND LOWER(older.email) = LOWER(org_members.email)
+          AND (
+            older.joined_at < org_members.joined_at
+            OR (older.joined_at = org_members.joined_at AND older.id < org_members.id)
+          )
+      )`,
+  },
+  {
+    // Closes the TOCTOU window in `acceptPendingInvitationsForEmail`
+    // (org/accept-pending.ts): a SELECT-then-INSERT check with no unique
+    // constraint standing behind the case-insensitive comparison every
+    // reader uses. Without this, two concurrent acceptances (e.g. a
+    // retried signup hook) can both pass the SELECT and both INSERT,
+    // producing duplicate membership rows. This expression index makes
+    // (org_id, LOWER(email)) unique at the database level so an
+    // `ON CONFLICT` insert (or a raw duplicate insert) is rejected
+    // instead of silently creating a second row.
+    version: 1010,
+    name: "org-members-unique-lower-email-idx",
+    sql: `CREATE UNIQUE INDEX IF NOT EXISTS org_members_org_lower_email_uidx ON org_members (org_id, LOWER(email))`,
+  },
 ];

package/corpus/core/src/package-lifecycle/index.ts

@@ -0,0 +1 @@
+export * from "./manifest.js";

package/corpus/core/src/package-lifecycle/manifest.ts

@@ -0,0 +1,120 @@
+export const AGENT_NATIVE_PACKAGE_MANIFEST_VERSION = 1 as const;
+
+export interface AgentNativePackageManifest {
+  manifestVersion: typeof AGENT_NATIVE_PACKAGE_MANIFEST_VERSION;
+  name: string;
+  actions: string[];
+  schemaEntryPoint: string;
+  docs: {
+    llms: string;
+    llmsFull: string;
+    skills: string[];
+  };
+  requiredSecrets: { key: string; label: string; optional?: boolean }[];
+  peerProviders: string[];
+  eject?: {
+    sourceRoot: string;
+    targetDirectory: string;
+  };
+}
+
+export function assertAgentNativePackageManifest(
+  value: unknown,
+): asserts value is AgentNativePackageManifest {
+  const manifest = value as Partial<AgentNativePackageManifest> | null;
+  if (!manifest || typeof manifest !== "object") {
+    throw new Error("Package manifest must be an object");
+  }
+  if (manifest.manifestVersion !== AGENT_NATIVE_PACKAGE_MANIFEST_VERSION) {
+    throw new Error(
+      `Unsupported package manifest version ${String(manifest.manifestVersion)}`,
+    );
+  }
+  if (!manifest.name || !manifest.schemaEntryPoint) {
+    throw new Error("Package manifest is missing name or schemaEntryPoint");
+  }
+  if (!/^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(manifest.name)) {
+    throw new Error(`Invalid package manifest name: ${manifest.name}`);
+  }
+  if (
+    !manifest.schemaEntryPoint.startsWith(`${manifest.name}/`) ||
+    !isSafeSpecifier(manifest.schemaEntryPoint)
+  ) {
+    throw new Error("Package manifest schemaEntryPoint is unsafe");
+  }
+  if (
+    !Array.isArray(manifest.actions) ||
+    !manifest.docs ||
+    !Array.isArray(manifest.docs.skills) ||
+    !Array.isArray(manifest.requiredSecrets) ||
+    !Array.isArray(manifest.peerProviders)
+  ) {
+    throw new Error("Package manifest contribution lists are invalid");
+  }
+  for (const action of manifest.actions) {
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(action)) {
+      throw new Error(`Invalid package action name: ${action}`);
+    }
+  }
+  for (const skill of manifest.docs.skills) {
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(skill)) {
+      throw new Error(`Invalid package skill name: ${skill}`);
+    }
+  }
+  for (const docPath of [manifest.docs.llms, manifest.docs.llmsFull]) {
+    if (!isSafeRelativePath(docPath)) {
+      throw new Error(`Unsafe package documentation path: ${docPath}`);
+    }
+  }
+  for (const secret of manifest.requiredSecrets) {
+    if (
+      !secret ||
+      !/^[A-Z][A-Z0-9_]*$/.test(secret.key) ||
+      typeof secret.label !== "string" ||
+      secret.label.length === 0 ||
+      secret.label.length > 120 ||
+      (secret.optional !== undefined && typeof secret.optional !== "boolean")
+    ) {
+      throw new Error("Invalid package requiredSecrets entry");
+    }
+  }
+  for (const provider of manifest.peerProviders) {
+    if (
+      typeof provider !== "string" ||
+      !/^[a-z0-9][a-z0-9-]*$/.test(provider)
+    ) {
+      throw new Error(`Invalid package peer provider: ${String(provider)}`);
+    }
+  }
+  if (
+    manifest.eject &&
+    (!isSafeRelativePath(manifest.eject.sourceRoot) ||
+      !isSafeRelativePath(manifest.eject.targetDirectory))
+  ) {
+    throw new Error("Package eject paths must be safe relative paths");
+  }
+}
+
+function isSafeRelativePath(value: unknown): value is string {
+  if (typeof value !== "string" || value.length === 0 || value.includes("\\")) {
+    return false;
+  }
+  if (
+    value.includes("\0") ||
+    value.startsWith("/") ||
+    pathSegments(value).includes("..")
+  ) {
+    return false;
+  }
+  return !value.split("/").includes("");
+}
+
+function isSafeSpecifier(value: string): boolean {
+  return (
+    /^[A-Za-z0-9@._/-]+$/.test(value) && !pathSegments(value).includes("..")
+  );
+}
+
+function pathSegments(value: string): string[] {
+  return value.split("/");
+}

package/corpus/core/src/provider-api/custom-registry.ts

@@ -64,6 +64,12 @@ export interface UpsertCustomProviderArgs {
   allowedHostSuffixes?: string[];
   defaultHeaders?: Record<string, string>;
   notes?: string;
+  /**
+   * Caller's org role in the target org (`scopeId` when `scope === "org"`),
+   * resolved by the caller (e.g. `provider-api-register.ts`) before invoking
+   * this function. Required — see `assertCanMutateCustomProviderScope`.
+   */
+  orgRole: string | null;
 }
 
 // ---------------------------------------------------------------------------
@@ -258,6 +264,53 @@ export function validateAllowedHostSuffixes(suffixes: string[]): string[] {
   return normalized;
 }
 
+// ---------------------------------------------------------------------------
+// Authorization
+// ---------------------------------------------------------------------------
+
+/**
+ * Thrown by `assertCanMutateCustomProviderScope` when the caller is not
+ * authorized to mutate a scoped custom provider row.
+ */
+export class CustomProviderAuthError extends Error {
+  constructor(
+    readonly statusCode: number,
+    message: string,
+  ) {
+    super(message);
+    this.name = "CustomProviderAuthError";
+  }
+}
+
+/**
+ * Defense-in-depth authorization guard for custom-provider mutations. Mirrors
+ * `assertCanMutateScope` in `server/scoped-key-storage.ts`: user-scoped writes
+ * need no role check (each user only ever mutates their own row), but
+ * org-scoped writes require the caller to be an owner or admin of the target
+ * org (`scopeId`) — otherwise a plain member could repoint an org-wide
+ * provider's base URL or attach a different credential key name that other
+ * members' agents then trust. `scopeId` is accepted (unused today) for
+ * signature parity with `assertCanMutateScope` in case a future scope value
+ * needs it (e.g. a solo-workspace carve-out).
+ *
+ * The only caller today is `provider-api-register.ts`, which resolves
+ * `orgRole` itself and enforces this same check before calling in; this
+ * function is the second, harder-to-bypass layer so a future caller can't
+ * reintroduce the gap by forgetting to check.
+ */
+export function assertCanMutateCustomProviderScope(
+  scope: CustomProviderScope,
+  _scopeId: string,
+  orgRole: string | null,
+): void {
+  if (scope === "user") return;
+  if (orgRole === "owner" || orgRole === "admin") return;
+  throw new CustomProviderAuthError(
+    403,
+    "Only organization owners and admins can register or modify org-scoped custom providers.",
+  );
+}
+
 // ---------------------------------------------------------------------------
 // CRUD
 // ---------------------------------------------------------------------------
@@ -269,6 +322,7 @@ export function validateAllowedHostSuffixes(suffixes: string[]): string[] {
 export async function upsertCustomProvider(
   args: UpsertCustomProviderArgs,
 ): Promise<string> {
+  assertCanMutateCustomProviderScope(args.scope, args.scopeId, args.orgRole);
   await ensureTable();
   validateProviderId(args.id);
   validateAuth(args.auth);
@@ -333,7 +387,9 @@ export async function deleteCustomProvider(
   scope: CustomProviderScope,
   scopeId: string,
   id: string,
+  orgRole: string | null,
 ): Promise<boolean> {
+  assertCanMutateCustomProviderScope(scope, scopeId, orgRole);
   await ensureTable();
   const client = getDbExec();
   const { rowsAffected } = await client.execute({

package/corpus/core/src/provider-api/index.ts

@@ -47,6 +47,8 @@ export {
   listCustomProviders,
   getCustomProvider,
   validateCustomBaseUrl,
+  assertCanMutateCustomProviderScope,
+  CustomProviderAuthError,
 } from "./custom-registry.js";
 
 export const PROVIDER_API_IDS = [

package/corpus/core/src/scripts/agent-engines/list-agent-engines.ts

@@ -15,6 +15,8 @@ import {
   normalizeModelForEngine,
 } from "../../agent/engine/index.js";
 import type { ActionTool } from "../../agent/types.js";
+import { resolveHostedDefaultModelExperiment } from "../../observability/hosted-model-experiment.js";
+import { getRequestUserEmail } from "../../server/request-context.js";
 import { getSetting } from "../../settings/index.js";
 
 export const tool: ActionTool = {
@@ -82,13 +84,23 @@ export async function run(args: Record<string, string> = {}): Promise<string> {
         ? current?.model
         : undefined;
   const currentEngineName = currentEntry?.name ?? "anthropic";
-  const currentModel =
+  let currentModel =
     currentEntry && !envUnavailable
       ? normalizeModelForEngine(
           currentEntry,
           currentModelCandidate ?? currentEntry.defaultModel,
         )
       : (currentModelCandidate ?? DEFAULT_MODEL);
+  const hostedExperiment =
+    currentEntry && !currentModelCandidate
+      ? resolveHostedDefaultModelExperiment({
+          userId: getRequestUserEmail(),
+          engineName: currentEntry.name,
+          isDefaultModelSelection: true,
+          supportedModels: currentEntry.supportedModels,
+        })
+      : null;
+  if (hostedExperiment) currentModel = hostedExperiment.model;
 
   const result = {
     engines: engines.map((e) => ({
@@ -107,6 +119,12 @@ export async function run(args: Record<string, string> = {}): Promise<string> {
       : {
           engine: currentEngineName,
           model: currentModel,
+          ...(hostedExperiment
+            ? {
+                modelSelectionSource: "experiment",
+                experimentAssignment: hostedExperiment.assignment,
+              }
+            : {}),
         },
   };
 

package/corpus/core/src/scripts/call-agent.ts

@@ -321,7 +321,14 @@ export async function run(
           orgDomain: callerOrgDomain,
           orgSecret: callerOrgSecret,
           onUpdate: onRemotePollUpdate,
-          ...(callTimeoutMs ? { timeoutMs: callTimeoutMs } : {}),
+          ...(callTimeoutMs
+            ? {
+                timeoutMs: callTimeoutMs,
+                // Integration callers must keep the timeout task id so the
+                // catch below can enqueue durable continuation polling.
+                returnRecoverableArtifactsOnTimeout: false,
+              }
+            : {}),
         });
         responseText =
           formatDownstreamLlmCredentialFailure(agent.name, responseText) ??
@@ -348,8 +355,23 @@ export async function run(
               `The ${agent.name} agent accepted this delegated subtask and will post its own final result to the originating integration thread automatically. ` +
               `Do not call ${agent.name} again for this same subtask. Continue any other requested work, then answer with the completed results you have; if needed, mention that ${agent.name} is posting its result separately.`;
           } else {
-            const reason = pollErr?.message ?? "unknown error";
-            responseText = `The ${agent.name} agent is taking longer than expected and didn't reply in time. (${reason})`;
+            // The normal integration path must preserve the timeout task id so
+            // it can enqueue a durable continuation. If that enqueue fails,
+            // do not hide receiver-verified artifacts that were already
+            // returned with the last poll; this mirrors callAgent's default
+            // timeout behavior without treating arbitrary remote status text
+            // as a completed response.
+            const recoverableArtifactText =
+              extractRecoverableTimeoutArtifactText(pollErr);
+            if (recoverableArtifactText) {
+              responseText = expandRelativeUrls(
+                recoverableArtifactText,
+                agent.url,
+              );
+            } else {
+              const reason = pollErr?.message ?? "unknown error";
+              responseText = `The ${agent.name} agent is taking longer than expected and didn't reply in time. (${reason})`;
+            }
           }
         } else {
           const reason = pollErr?.message ?? "unknown error";
@@ -490,6 +512,34 @@ function getA2ATaskTimeoutTaskId(err: unknown): string | null {
   return match?.[1] ?? null;
 }
 
+/**
+ * Mirrors the A2A client's default timeout recovery for the exceptional case
+ * where an integration cannot enqueue a durable continuation. Only an
+ * explicitly receiver-marked task message is safe to surface as a completed
+ * partial result; ordinary working-state text remains a timeout failure.
+ */
+function extractRecoverableTimeoutArtifactText(err: unknown): string {
+  const candidate = err as
+    | { lastTask?: Task | unknown; name?: unknown }
+    | null
+    | undefined;
+  const lastTask =
+    err instanceof A2ATaskTimeoutError
+      ? err.lastTask
+      : candidate?.name === "A2ATaskTimeoutError"
+        ? (candidate.lastTask as Task | undefined)
+        : undefined;
+  const message = lastTask?.status?.message;
+  if (!message?.metadata?.agentNativeRecoverableArtifacts) return "";
+
+  return message.parts
+    .filter(
+      (part): part is { type: "text"; text: string } => part.type === "text",
+    )
+    .map((part) => part.text)
+    .join("\n");
+}
+
 async function formatExistingIntegrationContinuationIfRetry(
   agent: {
     name: string;

package/corpus/core/src/scripts/chat/search-chats.ts

@@ -4,7 +4,7 @@
  * Search or list past agent chat threads.
  *
  * Usage:
- *   pnpm action search-chats [--query "search term"] [--limit N] [--format json]
+ *   pnpm action search-chats [--query "search term"] [--limit N] [--format json] [--includeArchived]
  */
 
 import { searchThreads, listThreads } from "../../chat-threads/store.js";
@@ -40,15 +40,17 @@ export default async function searchChats(args: string[]): Promise<void> {
     console.log(`Usage: pnpm action search-chats [options]
 
 Options:
-  --query <text>  Search chats by title, preview, or content
-  --limit N       Max results (default: 20)
-  --format json   Output as JSON
-  --help          Show this help message
+  --query <text>       Search chats by title, preview, or content
+  --limit N            Max results (default: 20)
+  --format json        Output as JSON
+  --includeArchived    Also include archived chats (excluded by default)
+  --help               Show this help message
 
 Examples:
   pnpm action search-chats --query "email setup"
   pnpm action search-chats --limit 5
-  pnpm action search-chats --format json`);
+  pnpm action search-chats --format json
+  pnpm action search-chats --includeArchived`);
     return;
   }
 
@@ -56,10 +58,11 @@ Examples:
   const limit = parsed.limit ? parseInt(parsed.limit, 10) : 20;
   if (isNaN(limit) || limit < 1) fail("--limit must be a positive integer");
 
+  const includeArchived = parsed.includeArchived === "true";
   const query = parsed.query;
   const threads = query
-    ? await searchThreads(owner, query, limit)
-    : await listThreads(owner, limit, 0);
+    ? await searchThreads(owner, query, limit, { includeArchived })
+    : await listThreads(owner, { limit, offset: 0, includeArchived });
 
   if (parsed.format === "json") {
     console.log(

package/corpus/core/src/secrets/register-framework-secrets.ts

@@ -22,7 +22,7 @@ export function registerFrameworkSecrets(): void {
       key: "OPENAI_API_KEY",
       label: "OpenAI API key",
       description:
-        "Enables realtime voice conversations with your app and optional OpenAI transcription.",
+        "Optional fallback for realtime voice when Builder is not connected, and for OpenAI transcription.",
       docsUrl: "https://platform.openai.com/api-keys",
       scope: "user",
       kind: "api-key",

package/corpus/core/src/secrets/storage.ts

@@ -142,37 +142,57 @@ export async function writeAppSecret(args: WriteSecretArgs): Promise<string> {
   const client = getDbExec();
   const now = Date.now();
   const encrypted = encryptValue(value);
+  const id = randomUUID();
 
-  // Upsert by (scope, scope_id, key). Keep the existing row's id on update so
-  // references stay stable.
-  const { rows } = await client.execute({
-    sql: `SELECT id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ?`,
-    args: [scope, scopeId, key],
-  });
-  if (rows.length > 0) {
-    const id = rows[0].id as string;
-    await client.execute({
-      sql: `UPDATE app_secrets SET encrypted_value = ?, description = ?, url_allowlist = ?, updated_at = ? WHERE id = ?`,
-      args: [encrypted, description ?? null, urlAllowlist ?? null, now, id],
+  // Atomic upsert by (scope, scope_id, key). Previously this was a
+  // SELECT-then-branch (UPDATE if found, else INSERT): under concurrent
+  // writers for the same key both could see "no row" and both attempt
+  // INSERT, and the loser threw a raw UNIQUE(scope, scope_id, key)
+  // constraint violation (a user-facing 500) instead of updating. A single
+  // `INSERT ... ON CONFLICT DO UPDATE` closes that window — it's one
+  // statement, so there's no gap between "check" and "act". `id` is
+  // deliberately left out of the `DO UPDATE SET` list so an existing row
+  // keeps its original id (any stored references stay stable); only a
+  // genuinely new row gets the freshly generated `id`. This syntax is
+  // portable across SQLite (UPSERT since 3.24) and Postgres.
+  const upsertSql = `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, description, url_allowlist, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT (scope, scope_id, key) DO UPDATE SET
+      encrypted_value = excluded.encrypted_value,
+      description = excluded.description,
+      url_allowlist = excluded.url_allowlist,
+      updated_at = excluded.updated_at`;
+  const upsertArgs = [
+    id,
+    scope,
+    scopeId,
+    key,
+    encrypted,
+    description ?? null,
+    urlAllowlist ?? null,
+    now,
+    now,
+  ];
+
+  if (isPostgres()) {
+    const { rows } = await client.execute({
+      sql: `${upsertSql} RETURNING id`,
+      args: upsertArgs,
     });
-    return id;
+    return String(rows[0]?.id ?? id);
   }
-  const id = randomUUID();
-  await client.execute({
-    sql: `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, description, url_allowlist, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-    args: [
-      id,
-      scope,
-      scopeId,
-      key,
-      encrypted,
-      description ?? null,
-      urlAllowlist ?? null,
-      now,
-      now,
-    ],
+
+  // SQLite: RETURNING support varies across better-sqlite3/libsql builds, so
+  // (matching the convention elsewhere in this codebase, e.g.
+  // integrations/pending-tasks-store.ts) re-read the id afterward instead of
+  // relying on it. The row is guaranteed to exist at this point, so this is
+  // a plain lookup rather than a TOCTOU-prone gate on the write itself.
+  await client.execute({ sql: upsertSql, args: upsertArgs });
+  const { rows } = await client.execute({
+    sql: `SELECT id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,
+    args: [scope, scopeId, key],
   });
-  return id;
+  return String(rows[0]?.id ?? id);
 }
 
 export interface ReadSecretResult {

package/corpus/core/src/server/action-discovery.ts

@@ -606,6 +606,10 @@ export async function mergeCoreSharingActions(
       () => import("../audit/actions/list-audit-events.js"),
     ],
     ["get-audit-event", () => import("../audit/actions/get-audit-event.js")],
+    [
+      "export-audit-events",
+      () => import("../audit/actions/export-audit-events.js"),
+    ],
     // History kit — reusable version snapshots and restore surface.
     [
       "create-resource-version",