@agent-native/core 0.95.1 → 0.97.0

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -8,6 +8,7 @@ import {
   getMethod,
   getQuery,
   getHeader,
+  getRequestIP,
   type H3Event,
 } from "h3";
 
@@ -19,7 +20,8 @@ import {
 } from "../a2a/artifact-response.js";
 import {
   hasConfiguredA2ASecret,
-  isA2AProductionRuntime,
+  isLoopbackAddress,
+  isTrustedLocalRuntime,
 } from "../a2a/auth-policy.js";
 import {
   applyAgentTextEventToBuffer,
@@ -54,11 +56,16 @@ import {
   listAgentEngines,
   registerBuiltinEngines,
 } from "../agent/engine/index.js";
-import type { AgentEngine, EngineMessage } from "../agent/engine/types.js";
+import type {
+  AgentEngine,
+  EngineMessage,
+  EngineTool,
+} from "../agent/engine/types.js";
 import {
   createProductionAgentHandler,
   actionsToEngineTools,
   executeAgentToolCall,
+  filterInitialEngineTools,
   getActiveRunForThreadAsync,
   abortRunDurably,
   subscribeToRun,
@@ -1060,6 +1067,10 @@ function appStateKeyForBrowserTab(key: string, browserTabId: unknown): string {
  */
 const generateTitleRateLimit = new Map<string, number[]>();
 
+/** Only sweep drained rate-limit entries once the map grows past this size,
+ * so the common small-map case stays O(1). */
+const RATE_LIMIT_SWEEP_THRESHOLD = 1000;
+
 /**
  * Creates the `set-search-params` / `set-url-path` tools. Writes a one-shot
  * URL command to application_state; the client's URLSync component applies
@@ -1903,6 +1914,11 @@ async function createChatScriptEntries(): Promise<Record<string, ActionEntry>> {
               description: "Output format",
               enum: ["json", "text"],
             },
+            includeArchived: {
+              type: "boolean",
+              description:
+                "Also include archived chats in the results. Archived chats are excluded by default.",
+            },
           },
         },
       },
@@ -1953,6 +1969,11 @@ async function createChatScriptEntries(): Promise<Record<string, ActionEntry>> {
                 description: "(search) Output format",
                 enum: ["json", "text"],
               },
+              includeArchived: {
+                type: "boolean",
+                description:
+                  "(search) Also include archived chats in the results. Archived chats are excluded by default, matching the 'archive' action's effect on the chat list.",
+              },
               id: {
                 type: "string",
                 description:
@@ -2940,6 +2961,22 @@ export function runA2AAgentLoop(
   );
 }
 
+/**
+ * Keep delegated A2A turns on the same compact initial tool surface as
+ * interactive chat. `tool-search` remains in the initial set, while the
+ * complete registry is supplied separately so the run loop can load a matched
+ * schema after a tool-search result.
+ */
+export function createA2AEngineToolSurface(
+  availableTools: EngineTool[],
+  initialToolNames?: string[],
+): { tools: EngineTool[]; availableTools: EngineTool[] } {
+  return {
+    tools: filterInitialEngineTools(availableTools, initialToolNames),
+    availableTools,
+  };
+}
+
 /**
  * Verbose framework sections returned by the `get-framework-context` tool.
  * Keyed by topic so the agent can request specific sections.
@@ -2971,9 +3008,9 @@ Use for charts, visualizations, previews. Don't use for simple text/tables or ex
   "chat-history": `### Chat History
 
 You can search and restore previous chat conversations using \`chat-history\`:
-- \`chat-history\` (action: "search") — Search or list past chat threads by keyword
+- \`chat-history\` (action: "search") — Search or list past chat threads by keyword. Archived threads are excluded by default; pass \`includeArchived: true\` to also see them.
 - \`chat-history\` (action: "open") — Open a chat thread in the UI as a new tab and focus it
-- \`chat-history\` (actions: "rename", "pin", "unpin", "archive") — Organize a known chat thread by ID
+- \`chat-history\` (actions: "rename", "pin", "unpin", "archive") — Organize a known chat thread by ID. Archiving a thread hides it from the default chat list and search.
 
 When the user asks to find a previous conversation, use \`chat-history\` with action "search" first to find matching threads, then action "open" to restore the one they want.`,
 
@@ -5077,7 +5114,10 @@ export function createAgentChatPlugin(
                 },
           );
 
-          const a2aTools = actionsToEngineTools(a2aActions);
+          const a2aToolSurface = createA2AEngineToolSurface(
+            actionsToEngineTools(a2aActions),
+            options?.initialToolNames,
+          );
 
           // Precise current time rides the user message (not the cached
           // system-prompt prefix) — same pattern as the interactive handler.
@@ -5098,7 +5138,7 @@ export function createAgentChatPlugin(
           const controller = new AbortController();
 
           console.log(
-            `[A2A] Starting agent loop: ${a2aTools.length} tools, prompt ${systemPrompt.length} chars`,
+            `[A2A] Starting agent loop: ${a2aToolSurface.tools.length}/${a2aToolSurface.availableTools.length} initial tools, prompt ${systemPrompt.length} chars`,
           );
 
           await runA2AAgentLoop(
@@ -5106,7 +5146,8 @@ export function createAgentChatPlugin(
               engine: a2aEngine,
               model,
               systemPrompt,
-              tools: a2aTools,
+              tools: a2aToolSurface.tools,
+              availableTools: a2aToolSurface.availableTools,
               messages: a2aMessages,
               actions: a2aActions,
               send: (event) => {
@@ -6516,12 +6557,17 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
               setResponseStatus(event, 401);
               return { error: "Invalid or expired processor token" };
             }
-          } else if (isA2AProductionRuntime()) {
-            setResponseStatus(event, 503);
-            return {
-              error:
-                "Agent Teams processor not configured — set A2A_SECRET on this deployment.",
-            };
+          } else {
+            const loopback = isLoopbackAddress(
+              getRequestIP(event, { xForwardedFor: false }),
+            );
+            if (!isTrustedLocalRuntime({ loopback })) {
+              setResponseStatus(event, 503);
+              return {
+                error:
+                  "Agent Teams processor not configured — set A2A_SECRET on this deployment (or A2A_ALLOW_UNSIGNED_INTERNAL=1 for trusted local dev).",
+              };
+            }
           }
 
           try {
@@ -7189,6 +7235,11 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
           setResponseHeader(event, "Content-Type", "application/x-ndjson");
           setResponseHeader(event, "Cache-Control", "no-cache");
 
+          // Lets `cancel()` signal in-flight source work to stop early on
+          // client disconnect, instead of only being noticed the next time
+          // `flush()`'s `controller.enqueue` throws.
+          const mentionsAbort = new AbortController();
+
           const stream = new ReadableStream({
             start(controller) {
               return runWithRequestContext(
@@ -7200,7 +7251,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
               );
             },
             cancel() {
-              // Client disconnected — stop enqueuing
+              // Client disconnected — stop enqueuing and let in-flight source
+              // work short-circuit instead of running to completion unseen.
+              mentionsAbort.abort();
             },
           });
 
@@ -7211,10 +7264,13 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
           ) {
             const MAX_RESULTS = 50;
             let totalSent = 0;
-            let cancelled = false;
+            let cancelled = mentionsAbort.signal.aborted;
 
             const flush = (batch: MentionItemResponse[]) => {
-              if (cancelled) return;
+              if (cancelled || mentionsAbort.signal.aborted) {
+                cancelled = true;
+                return;
+              }
               const filtered = batch.filter(matchesQuery);
               if (filtered.length === 0) return;
               const remaining = MAX_RESULTS - totalSent;
@@ -7297,6 +7353,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
 
             // 3. Custom mention providers (each flushes independently)
             for (const [key, provider] of Object.entries(mentionProviders)) {
+              // Client already disconnected — don't spawn more provider work.
+              if (mentionsAbort.signal.aborted) break;
               sources.push(
                 (async () => {
                   try {
@@ -7384,7 +7442,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             );
 
             await Promise.all(sources);
-            if (!cancelled) controller.close();
+            if (!cancelled && !mentionsAbort.signal.aborted) {
+              controller.close();
+            }
           }
         }),
       );
@@ -7415,6 +7475,19 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
           recent.push(now);
           generateTitleRateLimit.set(ownerEmail, recent);
 
+          // Opportunistic eviction: keep the map from growing unbounded by
+          // the count of distinct users on a long-lived process. Drop any
+          // key whose window has fully drained (no timestamps within the
+          // rolling window).
+          if (generateTitleRateLimit.size > RATE_LIMIT_SWEEP_THRESHOLD) {
+            for (const [email, times] of generateTitleRateLimit) {
+              if (email === ownerEmail) continue;
+              if (times.every((t) => now - t >= limitWindowMs)) {
+                generateTitleRateLimit.delete(email);
+              }
+            }
+          }
+
           const body = await readBody(event);
           const message = body?.message;
           if (!message || typeof message !== "string") {
@@ -8403,10 +8476,14 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
 
           // Validate + HMAC-authenticate the self-dispatch and prepare the
           // background-worker body. Pure decision (unit-tested in
-          // durable-background.spec.ts); the route only wires it to h3.
+          // durable-background.spec.ts); the route only wires it to h3. This
+          // handler DOES have the h3 event, so it can see the real socket
+          // peer — thread the loopback signal through so unsigned local-dev
+          // self-dispatch (no A2A_SECRET) still works over 127.0.0.1/::1.
           const prepared = prepareProcessRunRequest(
             processBody,
             getHeader(event, "authorization"),
+            isLoopbackAddress(getRequestIP(event, { xForwardedFor: false })),
           );
           if (!prepared.ok) {
             // DIAGNOSTIC: record the auth/validation failure ONTO the run

package/corpus/core/src/server/core-routes-plugin.ts

@@ -298,6 +298,7 @@ const BUILDER_WAITLIST_USE_CASES = new Set([
   BUILDER_WAITLIST_DEFAULT_USE_CASE,
   "design_publish_app",
   "docs_build_online_waitlist",
+  "docs_edit_online_waitlist",
 ]);
 const BUILDER_WAITLIST_FORM_TIMEOUT_MS = 8000;
 const BUILDER_WAITLIST_TEXT_LIMIT = 4000;
@@ -320,6 +321,7 @@ export interface BuilderWaitlistBody {
   appUrl?: unknown;
   pageUrl?: unknown;
   source?: unknown;
+  template?: unknown;
   useCase?: unknown;
 }
 
@@ -352,6 +354,13 @@ function normalizeBuilderWaitlistUseCase(value: unknown): string {
     : BUILDER_WAITLIST_DEFAULT_USE_CASE;
 }
 
+function normalizeBuilderWaitlistTemplate(value: unknown): string | undefined {
+  const template = cleanBuilderWaitlistText(value, 100);
+  return template && /^[a-z0-9][a-z0-9-]{0,99}$/.test(template)
+    ? template
+    : undefined;
+}
+
 function isValidWaitlistEmail(email: string): boolean {
   return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
 }
@@ -506,6 +515,7 @@ export function buildBuilderWaitlistFormPayload(
     getOrigin(event);
   const source =
     cleanBuilderWaitlistText(body.source, 100) ?? BUILDER_WAITLIST_FORM_SOURCE;
+  const template = normalizeBuilderWaitlistTemplate(body.template);
   const useCase = normalizeBuilderWaitlistUseCase(body.useCase);
 
   return {
@@ -515,6 +525,7 @@ export function buildBuilderWaitlistFormPayload(
       appUrl,
       prompt: cleanBuilderWaitlistText(body.prompt),
       source,
+      template,
       useCase,
     },
     _hp: "",
@@ -522,6 +533,7 @@ export function buildBuilderWaitlistFormPayload(
       submitterEmail: sessionEmail,
       pageUrl: appUrl,
       source,
+      template,
       useCase,
     },
   };
@@ -1157,12 +1169,20 @@ export function createCoreRoutesPlugin(
         }),
       );
 
-      // Defense-in-depth CSRF check for state-changing /_agent-native/* routes.
-      // Mounted AFTER the CORS layer so disallowed-origin OPTIONS preflights
-      // 403 first (rather than being rejected on a stale cookie heuristic).
-      // See `csrf.ts` for the threat model and allowlist.
-      const { createCsrfMiddleware } = await import("./csrf.js");
-      getH3App(nitroApp).use(createCsrfMiddleware(P));
+      // Defense-in-depth CSRF check for state-changing /_agent-native/* routes
+      // (see `csrf.ts` for the threat model and allowlist) is registered by
+      // `getH3App()` itself (framework-request-handler.ts), synchronously, on
+      // the very first call to `getH3App(nitroApp)` for this process — NOT
+      // here. Registering it inside this plugin's own async init chain would
+      // race against agent-chat-plugin's action-route registration (a
+      // SEPARATE, independently-async-initialized Nitro plugin file in real
+      // deployments): whichever plugin's `getH3App(nitroApp).use(...)` call
+      // happened to resolve first would win the position in the middleware
+      // array, and CSRF losing that race would let an action route match and
+      // run before the CSRF check ever saw the request. Centralizing the
+      // registration in `getH3App()`'s one-time bootstrap makes it the first
+      // middleware any plugin's route can possibly land behind, regardless of
+      // plugin init ordering.
 
       // Agent discovery primitive — shared by headless CLI/A2A surfaces and
       // UI shells that need to show connected peer apps without depending on
@@ -1263,8 +1283,11 @@ export function createCoreRoutesPlugin(
             return { error: "executionId required" };
           }
 
-          const { hasConfiguredA2ASecret, isA2AProductionRuntime } =
-            await import("../a2a/auth-policy.js");
+          const {
+            hasConfiguredA2ASecret,
+            isLoopbackAddress,
+            isTrustedLocalRuntime,
+          } = await import("../a2a/auth-policy.js");
           if (hasConfiguredA2ASecret()) {
             const { verifyInternalToken, extractBearerToken } =
               await import("../integrations/internal-token.js");
@@ -1273,12 +1296,17 @@ export function createCoreRoutesPlugin(
               setResponseStatus(event, 401);
               return { error: "Invalid or expired processor token" };
             }
-          } else if (isA2AProductionRuntime()) {
-            setResponseStatus(event, 503);
-            return {
-              error:
-                "Sandbox execution processor not configured — set A2A_SECRET on this deployment.",
-            };
+          } else {
+            const loopback = isLoopbackAddress(
+              getRequestIP(event, { xForwardedFor: false }),
+            );
+            if (!isTrustedLocalRuntime({ loopback })) {
+              setResponseStatus(event, 503);
+              return {
+                error:
+                  "Sandbox execution processor not configured — set A2A_SECRET on this deployment (or A2A_ALLOW_UNSIGNED_INTERNAL=1 for trusted local dev).",
+              };
+            }
           }
 
           try {
@@ -2021,6 +2049,7 @@ export function createCoreRoutesPlugin(
             body,
           );
           const waitlistSource = waitlistPayload.data.source;
+          const waitlistTemplate = waitlistPayload.data.template;
           const waitlistUseCase = waitlistPayload.data.useCase;
           let formSubmission: { submitted: boolean; formId?: string };
           try {
@@ -2039,6 +2068,7 @@ export function createCoreRoutesPlugin(
                   err instanceof Error ? err.message : "unknown_waitlist_error",
                 source: waitlistSource,
                 stage: "waitlist",
+                template: waitlistTemplate ?? null,
                 useCase: waitlistUseCase,
               },
             );
@@ -2057,6 +2087,7 @@ export function createCoreRoutesPlugin(
               formSubmitted: formSubmission.submitted,
               source: waitlistSource,
               stage: "waitlist",
+              template: waitlistTemplate ?? null,
               useCase: waitlistUseCase,
             },
           );

package/corpus/core/src/server/csrf.ts

@@ -50,6 +50,8 @@ import {
   setResponseStatus,
 } from "h3";
 
+import { getConfiguredAppBasePath } from "./app-base-path.js";
+
 /**
  * Path prefixes (relative to the framework prefix `/_agent-native`) that are
  * allowed to receive cross-origin state-changing POSTs without first-party
@@ -144,9 +146,10 @@ function requestHasCookies(event: any): boolean {
 }
 
 /**
- * Path passed in is the full request URL pathname (e.g. `/_agent-native/actions/foo`).
- * `frameworkPrefix` should be the framework route prefix without trailing slash,
- * e.g. `/_agent-native`.
+ * The path is the full request URL pathname (e.g.
+ * `/_agent-native/actions/foo` or `/app/_agent-native/actions/foo`).
+ * `frameworkPrefix` is the root framework route prefix without a trailing
+ * slash, e.g. `/_agent-native`.
  */
 function isOnAllowlist(pathname: string, frameworkPrefix: string): boolean {
   if (!pathname.startsWith(frameworkPrefix)) return false;
@@ -157,6 +160,21 @@ function isOnAllowlist(pathname: string, frameworkPrefix: string): boolean {
   return false;
 }
 
+function matchingFrameworkPrefix(
+  pathname: string,
+  frameworkPrefix: string,
+): string | undefined {
+  if (pathname.startsWith(frameworkPrefix)) return frameworkPrefix;
+
+  const basePath = getConfiguredAppBasePath();
+  const basePathFrameworkPrefix = `${basePath}${frameworkPrefix}`;
+  if (basePath && pathname.startsWith(basePathFrameworkPrefix)) {
+    return basePathFrameworkPrefix;
+  }
+
+  return undefined;
+}
+
 /**
  * Create the framework CSRF middleware.
  *
@@ -176,8 +194,9 @@ export function createCsrfMiddleware(
     if (!STATE_CHANGING_METHODS.has(method)) return undefined;
 
     const pathname = event.url?.pathname ?? "";
-    if (!pathname.startsWith(frameworkPrefix)) return undefined;
-    if (isOnAllowlist(pathname, frameworkPrefix)) return undefined;
+    const matchingPrefix = matchingFrameworkPrefix(pathname, frameworkPrefix);
+    if (!matchingPrefix) return undefined;
+    if (isOnAllowlist(pathname, matchingPrefix)) return undefined;
 
     // No cookie = no risk of confused-deputy CSRF on the session cookie.
     if (!requestHasCookies(event)) return undefined;

package/corpus/core/src/server/framework-request-handler.ts

@@ -17,6 +17,7 @@ import { setResponseHeader, setResponseStatus } from "h3";
 import { getMissingDefaultPlugins } from "../deploy/route-discovery.js";
 import { getConfiguredAppBasePath } from "./app-base-path.js";
 import { captureError } from "./capture-error.js";
+import { createCsrfMiddleware } from "./csrf.js";
 
 const BOOTSTRAPPED = new WeakSet<object>();
 const IN_BOOTSTRAP = new WeakSet<object>();
@@ -164,6 +165,27 @@ export function getH3App(nitroApp: any): H3AppShim {
       prepend: true,
     });
 
+    // CSRF (see csrf.ts): registered here — synchronously, on the very
+    // first `getH3App()` call for this nitroApp — rather than inside
+    // createCoreRoutesPlugin's own async init chain. Real deployments mount
+    // core-routes and agent-chat as SEPARATE, independently-async-initialized
+    // Nitro plugin files with no explicit ordering between them; both
+    // eventually call `getH3App(nitroApp).use(...)` to register their own
+    // routes (CSRF, action routes) after their own async setup (DB reads,
+    // dynamic imports) resolves in unpredictable relative order. The
+    // readiness gate above only guarantees every tracked plugin has FINISHED
+    // registering by the time a gated request is released — it does NOT
+    // guarantee CSRF's registration call happens to `.push()` onto
+    // `~middleware` before an action route's does. If agent-chat's action
+    // route push happened to land first, that route would match and run
+    // before CSRF ever saw the request. Registering CSRF here instead makes
+    // it the first non-prepended middleware pushed onto the array for this
+    // nitroApp, full stop — every plugin's own route registrations reach
+    // `getH3App()` (and therefore run after this point) before they can
+    // register anything, regardless of which plugin's async chain resolves
+    // first.
+    registerMiddleware(nitroApp, "", createCsrfMiddleware());
+
     // Primary gate: Nitro bridges this `request` hook to h3's `config.onRequest`,
     // which h3 awaits BEFORE `handler()` snapshots middleware and resolves the
     // route. The middleware gate above runs too late on production dispatchers —
@@ -466,7 +488,18 @@ function registerMiddleware(
     let originalPathname: string | undefined;
     let originalEventPath: string | undefined;
     let hadEventPath = false;
+    // Only true once this specific middleware invocation has actually
+    // stripped a mount prefix (i.e. `path` was non-empty and matched).
+    // Global (`path === ""`) middleware never mutates event.path/pathname,
+    // so `restoreOriginalPath` must be a no-op for it — otherwise it would
+    // unconditionally `delete event.path` on every pass-through (hadEventPath
+    // defaults to false), corrupting the event for any middleware that runs
+    // later in the chain (a real bug: two or more global middlewares in
+    // sequence, e.g. security-headers + CORS + CSRF, would wipe event.path
+    // for everything downstream, including the final route handler).
+    let didStripPath = false;
     const restoreOriginalPath = () => {
+      if (!didStripPath) return;
       if (originalPathname !== undefined) {
         try {
           event.url.pathname = originalPathname;
@@ -502,6 +535,7 @@ function registerMiddleware(
       const eventAny = event as any;
       hadEventPath = "path" in eventAny;
       originalEventPath = eventAny.path;
+      didStripPath = true;
       try {
         originalPathname = event.url.pathname;
         // Save the full path in context so handlers that need the original URL

package/corpus/core/src/server/google-realtime-session.ts

@@ -3,7 +3,6 @@ import { readFile } from "node:fs/promises";
 import {
   defineEventHandler,
   getMethod,
-  getRequestHeader,
   readBody,
   setResponseStatus,
   type H3Event,
@@ -15,6 +14,7 @@ import { readAppSecret } from "../secrets/storage.js";
 import { getSession } from "./auth.js";
 import { resolveBuilderCredentials } from "./credential-provider.js";
 import { runWithRequestContext } from "./request-context.js";
+import { isSameOriginRequest } from "./request-origin.js";
 
 interface GoogleRealtimeSessionResponse {
   websocketUrl: string;
@@ -22,41 +22,6 @@ interface GoogleRealtimeSessionResponse {
   websocketProtocol?: string;
 }
 
-function isSameOriginRequest(event: H3Event): boolean {
-  const host = getRequestHeader(event, "host");
-  const origin = getRequestHeader(event, "origin");
-  if (origin && host) {
-    try {
-      const parsed = new URL(origin);
-      if (parsed.host === host) return true;
-      if (parsed.protocol === "tauri:" && parsed.hostname === "localhost") {
-        return true;
-      }
-      if (
-        (parsed.protocol === "http:" || parsed.protocol === "https:") &&
-        parsed.hostname === "tauri.localhost" &&
-        (host.startsWith("localhost:") || host.startsWith("127.0.0.1:"))
-      ) {
-        return true;
-      }
-      if (
-        parsed.protocol === "http:" &&
-        (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") &&
-        parsed.port === "1420" &&
-        (host.startsWith("localhost:") || host.startsWith("127.0.0.1:"))
-      ) {
-        return true;
-      }
-      return false;
-    } catch {
-      return false;
-    }
-  }
-  const fetchSite = getRequestHeader(event, "sec-fetch-site");
-  if (fetchSite) return fetchSite === "same-origin" || fetchSite === "none";
-  return true;
-}
-
 export async function resolveGoogleRealtimeCredentials(opts: {
   userEmail?: string | null;
   orgId?: string | null;

package/corpus/core/src/server/poll.ts

@@ -738,9 +738,31 @@ async function getDurableChangesSinceForUser(
   }
 
   try {
+    // Scope the fetch to rows that could ever be visible to this caller
+    // before paying to JSON.parse and visibility-check every deployment-wide
+    // event: deployment-global rows (no owner, no org), the caller's own
+    // rows, the caller's org's rows, and resource-scoped rows (owner/org
+    // don't gate those — access is decided below by
+    // `getChangeVisibilityForUser`'s access-aware branch, which can grant a
+    // non-owner sharee, so resource-scoped rows must still flow through that
+    // check regardless of who owns them). This lets Postgres/SQLite use the
+    // `sync_events_owner_version_idx` / `sync_events_org_version_idx` indexes
+    // instead of scanning every tenant's activity on every poll. The OR group
+    // is parenthesized so `version > ?` ANDs against the whole group, not
+    // just the first term. A caller with no org passes a null `orgId` bind
+    // param, which makes `org_id = ?` evaluate to no match for every row
+    // (including null-org rows) in both dialects — mirroring the
+    // `event.orgId && orgId` truthy check in `getChangeVisibilityForUser`.
     const result = await getDbExec().execute({
-      sql: `SELECT version, event_json FROM sync_events WHERE version > ? ORDER BY version ASC LIMIT ?`,
-      args: [since, DURABLE_READ_LIMIT + 1],
+      sql: `SELECT version, event_json FROM sync_events WHERE version > ?
+              AND (
+                (owner IS NULL AND org_id IS NULL)
+                OR owner = ?
+                OR org_id = ?
+                OR resource_type IS NOT NULL
+              )
+            ORDER BY version ASC LIMIT ?`,
+      args: [since, userEmail, orgId ?? null, DURABLE_READ_LIMIT + 1],
     });
     const events: ChangeEvent[] = [];
     let version = Math.max(_version, since);