@agent-native/core 0.96.0 → 0.97.0

package/corpus/core/src/guards/scan-utils.ts

@@ -0,0 +1,105 @@
+/**
+ * Shared file-walking / offset helpers used by every guard in this
+ * directory. Ported (behavior-for-behavior) from the identical helpers
+ * duplicated across `scripts/guard-*.mjs` — see each guard file for the
+ * specific `scripts/guard-<name>.mjs` it was derived from.
+ *
+ * The original scripts walk directories with `fs/promises` async
+ * generators. Guard functions here are synchronous pure functions (per the
+ * plan's `scan<Name>(options): GuardResult` contract), so this module uses
+ * `fs.readdirSync` instead — same skip-dir semantics, no behavior change.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+
+/** Directories skipped by every guard's repo/app walk. */
+export const DEFAULT_SKIP_DIRS = new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  ".next",
+  ".nuxt",
+  ".output",
+  ".cache",
+  ".turbo",
+  ".netlify",
+  ".vercel",
+  ".wrangler",
+  ".react-router",
+  ".generated",
+  ".claude",
+  "out",
+  "coverage",
+]);
+
+/** Recursively walk `dir`, yielding absolute file paths. Skips any
+ * directory whose basename is in `skipDirs`. */
+export function* walk(
+  dir: string,
+  skipDirs: Set<string> = DEFAULT_SKIP_DIRS,
+): Generator<string> {
+  let entries: fs.Dirent[];
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (skipDirs.has(entry.name)) continue;
+      yield* walk(full, skipDirs);
+    } else if (entry.isFile()) {
+      yield full;
+    }
+  }
+}
+
+export function lineColForOffset(
+  contents: string,
+  offset: number,
+): { line: number; col: number } {
+  let line = 1;
+  let lineStart = 0;
+  for (let i = 0; i < offset; i++) {
+    if (contents.charCodeAt(i) === 10) {
+      line++;
+      lineStart = i + 1;
+    }
+  }
+  return { line, col: offset - lineStart + 1 };
+}
+
+export function isCommentLine(lineText: string): boolean {
+  const trimmed = lineText.trimStart();
+  return (
+    trimmed.startsWith("*") ||
+    trimmed.startsWith("//") ||
+    trimmed.startsWith("/*")
+  );
+}
+
+export function relPosix(root: string, file: string): string {
+  return path.relative(root, file).replaceAll("\\", "/");
+}
+
+export function readFileSafe(file: string): string | null {
+  try {
+    return fs.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+}
+
+/** True if `rel` matches an exact-path entry in `extraExemptPaths`
+ * (posix-relative, exact string match — the same shape the exempt-path
+ * sets used in the original monorepo guards). */
+export function isExtraExempt(
+  rel: string,
+  extraExemptPaths: string[] | undefined,
+): boolean {
+  if (!extraExemptPaths || extraExemptPaths.length === 0) return false;
+  return extraExemptPaths.includes(rel);
+}

package/corpus/core/src/guards/types.ts

@@ -0,0 +1,30 @@
+/**
+ * Shared types for `agent-native doctor`'s guard functions.
+ *
+ * Each guard is a pure function `scan<Name>(options): GuardResult` that
+ * scans a single app root and returns a flat list of findings. Guards do
+ * not print, exit, or read `agent-native.json` themselves — that
+ * orchestration lives in `../cli/doctor.ts` so the functions stay pure and
+ * independently testable/importable (see the `./guards` package export).
+ */
+
+export interface GuardFinding {
+  /** Path to the offending file, relative to the scanned root. */
+  file: string;
+  /** 1-based line number of the offending line. */
+  line: number;
+  /** Human-readable explanation of the finding. */
+  message: string;
+}
+
+export interface GuardResult {
+  /** Stable guard identifier, e.g. "no-drizzle-push". Matches the name used
+   * by `--only` and `agent-native.json`'s `doctor.disabledGuards`. */
+  name: string;
+  findings: GuardFinding[];
+}
+
+export interface GuardScanOptions {
+  /** Absolute path to the app root to scan. */
+  root: string;
+}

package/corpus/core/src/org/accept-pending.ts

@@ -63,8 +63,16 @@ export async function acceptPendingInvitationsForEmail(
     });
     if (existing.rows.length === 0) {
       const role = inv.role === "admin" ? "admin" : "member";
+      // The SELECT above is a cheap pre-check, not a correctness guard —
+      // two concurrent acceptances (e.g. a retried signup hook) can both
+      // pass it before either INSERT commits. `ON CONFLICT (org_id,
+      // LOWER(email)) DO NOTHING` targets the unique expression index
+      // added in migrations.ts (org-members-unique-lower-email-idx) so the
+      // race's loser is a silent no-op instead of a thrown unique
+      // constraint violation or a duplicate row.
       await db.execute({
-        sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
+        sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)
+              ON CONFLICT (org_id, LOWER(email)) DO NOTHING`,
         args: [nanoid(), inv.orgId, email, role, Date.now()],
       });
     }

package/corpus/core/src/org/migrations.ts

@@ -61,4 +61,45 @@ export const ORG_MIGRATIONS = [
     version: 1008,
     sql: `CREATE INDEX IF NOT EXISTS organizations_lower_allowed_domain_idx ON organizations (LOWER(allowed_domain))`,
   },
+  {
+    // De-dup pass ahead of the unique index below. `org_members` has always
+    // had a `UNIQUE(org_id, email)` constraint (see v1002), but that's an
+    // exact-string match — callers that insert a session's raw-case email
+    // (e.g. handlers.ts's acceptInvitationHandler) can still create a
+    // second row for the same person under a different case, and every
+    // membership *read* in this module already matches case-insensitively
+    // via `LOWER(email)`. This keeps exactly one row per (org_id,
+    // LOWER(email)) — the row with the oldest `joined_at` (ties broken by
+    // `id` for determinism) — by deleting any row for which a strictly
+    // "older" row exists in the same group. Portable across SQLite and
+    // Postgres (plain correlated EXISTS subquery, no window functions).
+    // Must run before the unique index below or that CREATE would fail on
+    // any database that already has case-variant duplicates.
+    version: 1009,
+    name: "org-members-dedupe-lower-email",
+    sql: `DELETE FROM org_members
+      WHERE EXISTS (
+        SELECT 1 FROM org_members older
+        WHERE older.org_id = org_members.org_id
+          AND LOWER(older.email) = LOWER(org_members.email)
+          AND (
+            older.joined_at < org_members.joined_at
+            OR (older.joined_at = org_members.joined_at AND older.id < org_members.id)
+          )
+      )`,
+  },
+  {
+    // Closes the TOCTOU window in `acceptPendingInvitationsForEmail`
+    // (org/accept-pending.ts): a SELECT-then-INSERT check with no unique
+    // constraint standing behind the case-insensitive comparison every
+    // reader uses. Without this, two concurrent acceptances (e.g. a
+    // retried signup hook) can both pass the SELECT and both INSERT,
+    // producing duplicate membership rows. This expression index makes
+    // (org_id, LOWER(email)) unique at the database level so an
+    // `ON CONFLICT` insert (or a raw duplicate insert) is rejected
+    // instead of silently creating a second row.
+    version: 1010,
+    name: "org-members-unique-lower-email-idx",
+    sql: `CREATE UNIQUE INDEX IF NOT EXISTS org_members_org_lower_email_uidx ON org_members (org_id, LOWER(email))`,
+  },
 ];

package/corpus/core/src/package-lifecycle/index.ts

@@ -0,0 +1 @@
+export * from "./manifest.js";

package/corpus/core/src/package-lifecycle/manifest.ts

@@ -0,0 +1,120 @@
+export const AGENT_NATIVE_PACKAGE_MANIFEST_VERSION = 1 as const;
+
+export interface AgentNativePackageManifest {
+  manifestVersion: typeof AGENT_NATIVE_PACKAGE_MANIFEST_VERSION;
+  name: string;
+  actions: string[];
+  schemaEntryPoint: string;
+  docs: {
+    llms: string;
+    llmsFull: string;
+    skills: string[];
+  };
+  requiredSecrets: { key: string; label: string; optional?: boolean }[];
+  peerProviders: string[];
+  eject?: {
+    sourceRoot: string;
+    targetDirectory: string;
+  };
+}
+
+export function assertAgentNativePackageManifest(
+  value: unknown,
+): asserts value is AgentNativePackageManifest {
+  const manifest = value as Partial<AgentNativePackageManifest> | null;
+  if (!manifest || typeof manifest !== "object") {
+    throw new Error("Package manifest must be an object");
+  }
+  if (manifest.manifestVersion !== AGENT_NATIVE_PACKAGE_MANIFEST_VERSION) {
+    throw new Error(
+      `Unsupported package manifest version ${String(manifest.manifestVersion)}`,
+    );
+  }
+  if (!manifest.name || !manifest.schemaEntryPoint) {
+    throw new Error("Package manifest is missing name or schemaEntryPoint");
+  }
+  if (!/^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(manifest.name)) {
+    throw new Error(`Invalid package manifest name: ${manifest.name}`);
+  }
+  if (
+    !manifest.schemaEntryPoint.startsWith(`${manifest.name}/`) ||
+    !isSafeSpecifier(manifest.schemaEntryPoint)
+  ) {
+    throw new Error("Package manifest schemaEntryPoint is unsafe");
+  }
+  if (
+    !Array.isArray(manifest.actions) ||
+    !manifest.docs ||
+    !Array.isArray(manifest.docs.skills) ||
+    !Array.isArray(manifest.requiredSecrets) ||
+    !Array.isArray(manifest.peerProviders)
+  ) {
+    throw new Error("Package manifest contribution lists are invalid");
+  }
+  for (const action of manifest.actions) {
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(action)) {
+      throw new Error(`Invalid package action name: ${action}`);
+    }
+  }
+  for (const skill of manifest.docs.skills) {
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(skill)) {
+      throw new Error(`Invalid package skill name: ${skill}`);
+    }
+  }
+  for (const docPath of [manifest.docs.llms, manifest.docs.llmsFull]) {
+    if (!isSafeRelativePath(docPath)) {
+      throw new Error(`Unsafe package documentation path: ${docPath}`);
+    }
+  }
+  for (const secret of manifest.requiredSecrets) {
+    if (
+      !secret ||
+      !/^[A-Z][A-Z0-9_]*$/.test(secret.key) ||
+      typeof secret.label !== "string" ||
+      secret.label.length === 0 ||
+      secret.label.length > 120 ||
+      (secret.optional !== undefined && typeof secret.optional !== "boolean")
+    ) {
+      throw new Error("Invalid package requiredSecrets entry");
+    }
+  }
+  for (const provider of manifest.peerProviders) {
+    if (
+      typeof provider !== "string" ||
+      !/^[a-z0-9][a-z0-9-]*$/.test(provider)
+    ) {
+      throw new Error(`Invalid package peer provider: ${String(provider)}`);
+    }
+  }
+  if (
+    manifest.eject &&
+    (!isSafeRelativePath(manifest.eject.sourceRoot) ||
+      !isSafeRelativePath(manifest.eject.targetDirectory))
+  ) {
+    throw new Error("Package eject paths must be safe relative paths");
+  }
+}
+
+function isSafeRelativePath(value: unknown): value is string {
+  if (typeof value !== "string" || value.length === 0 || value.includes("\\")) {
+    return false;
+  }
+  if (
+    value.includes("\0") ||
+    value.startsWith("/") ||
+    pathSegments(value).includes("..")
+  ) {
+    return false;
+  }
+  return !value.split("/").includes("");
+}
+
+function isSafeSpecifier(value: string): boolean {
+  return (
+    /^[A-Za-z0-9@._/-]+$/.test(value) && !pathSegments(value).includes("..")
+  );
+}
+
+function pathSegments(value: string): string[] {
+  return value.split("/");
+}

package/corpus/core/src/provider-api/custom-registry.ts

@@ -64,6 +64,12 @@ export interface UpsertCustomProviderArgs {
   allowedHostSuffixes?: string[];
   defaultHeaders?: Record<string, string>;
   notes?: string;
+  /**
+   * Caller's org role in the target org (`scopeId` when `scope === "org"`),
+   * resolved by the caller (e.g. `provider-api-register.ts`) before invoking
+   * this function. Required — see `assertCanMutateCustomProviderScope`.
+   */
+  orgRole: string | null;
 }
 
 // ---------------------------------------------------------------------------
@@ -258,6 +264,53 @@ export function validateAllowedHostSuffixes(suffixes: string[]): string[] {
   return normalized;
 }
 
+// ---------------------------------------------------------------------------
+// Authorization
+// ---------------------------------------------------------------------------
+
+/**
+ * Thrown by `assertCanMutateCustomProviderScope` when the caller is not
+ * authorized to mutate a scoped custom provider row.
+ */
+export class CustomProviderAuthError extends Error {
+  constructor(
+    readonly statusCode: number,
+    message: string,
+  ) {
+    super(message);
+    this.name = "CustomProviderAuthError";
+  }
+}
+
+/**
+ * Defense-in-depth authorization guard for custom-provider mutations. Mirrors
+ * `assertCanMutateScope` in `server/scoped-key-storage.ts`: user-scoped writes
+ * need no role check (each user only ever mutates their own row), but
+ * org-scoped writes require the caller to be an owner or admin of the target
+ * org (`scopeId`) — otherwise a plain member could repoint an org-wide
+ * provider's base URL or attach a different credential key name that other
+ * members' agents then trust. `scopeId` is accepted (unused today) for
+ * signature parity with `assertCanMutateScope` in case a future scope value
+ * needs it (e.g. a solo-workspace carve-out).
+ *
+ * The only caller today is `provider-api-register.ts`, which resolves
+ * `orgRole` itself and enforces this same check before calling in; this
+ * function is the second, harder-to-bypass layer so a future caller can't
+ * reintroduce the gap by forgetting to check.
+ */
+export function assertCanMutateCustomProviderScope(
+  scope: CustomProviderScope,
+  _scopeId: string,
+  orgRole: string | null,
+): void {
+  if (scope === "user") return;
+  if (orgRole === "owner" || orgRole === "admin") return;
+  throw new CustomProviderAuthError(
+    403,
+    "Only organization owners and admins can register or modify org-scoped custom providers.",
+  );
+}
+
 // ---------------------------------------------------------------------------
 // CRUD
 // ---------------------------------------------------------------------------
@@ -269,6 +322,7 @@ export function validateAllowedHostSuffixes(suffixes: string[]): string[] {
 export async function upsertCustomProvider(
   args: UpsertCustomProviderArgs,
 ): Promise<string> {
+  assertCanMutateCustomProviderScope(args.scope, args.scopeId, args.orgRole);
   await ensureTable();
   validateProviderId(args.id);
   validateAuth(args.auth);
@@ -333,7 +387,9 @@ export async function deleteCustomProvider(
   scope: CustomProviderScope,
   scopeId: string,
   id: string,
+  orgRole: string | null,
 ): Promise<boolean> {
+  assertCanMutateCustomProviderScope(scope, scopeId, orgRole);
   await ensureTable();
   const client = getDbExec();
   const { rowsAffected } = await client.execute({

package/corpus/core/src/provider-api/index.ts

@@ -47,6 +47,8 @@ export {
   listCustomProviders,
   getCustomProvider,
   validateCustomBaseUrl,
+  assertCanMutateCustomProviderScope,
+  CustomProviderAuthError,
 } from "./custom-registry.js";
 
 export const PROVIDER_API_IDS = [

package/corpus/core/src/secrets/storage.ts

@@ -142,37 +142,57 @@ export async function writeAppSecret(args: WriteSecretArgs): Promise<string> {
   const client = getDbExec();
   const now = Date.now();
   const encrypted = encryptValue(value);
+  const id = randomUUID();
 
-  // Upsert by (scope, scope_id, key). Keep the existing row's id on update so
-  // references stay stable.
-  const { rows } = await client.execute({
-    sql: `SELECT id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ?`,
-    args: [scope, scopeId, key],
-  });
-  if (rows.length > 0) {
-    const id = rows[0].id as string;
-    await client.execute({
-      sql: `UPDATE app_secrets SET encrypted_value = ?, description = ?, url_allowlist = ?, updated_at = ? WHERE id = ?`,
-      args: [encrypted, description ?? null, urlAllowlist ?? null, now, id],
+  // Atomic upsert by (scope, scope_id, key). Previously this was a
+  // SELECT-then-branch (UPDATE if found, else INSERT): under concurrent
+  // writers for the same key both could see "no row" and both attempt
+  // INSERT, and the loser threw a raw UNIQUE(scope, scope_id, key)
+  // constraint violation (a user-facing 500) instead of updating. A single
+  // `INSERT ... ON CONFLICT DO UPDATE` closes that window — it's one
+  // statement, so there's no gap between "check" and "act". `id` is
+  // deliberately left out of the `DO UPDATE SET` list so an existing row
+  // keeps its original id (any stored references stay stable); only a
+  // genuinely new row gets the freshly generated `id`. This syntax is
+  // portable across SQLite (UPSERT since 3.24) and Postgres.
+  const upsertSql = `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, description, url_allowlist, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT (scope, scope_id, key) DO UPDATE SET
+      encrypted_value = excluded.encrypted_value,
+      description = excluded.description,
+      url_allowlist = excluded.url_allowlist,
+      updated_at = excluded.updated_at`;
+  const upsertArgs = [
+    id,
+    scope,
+    scopeId,
+    key,
+    encrypted,
+    description ?? null,
+    urlAllowlist ?? null,
+    now,
+    now,
+  ];
+
+  if (isPostgres()) {
+    const { rows } = await client.execute({
+      sql: `${upsertSql} RETURNING id`,
+      args: upsertArgs,
     });
-    return id;
+    return String(rows[0]?.id ?? id);
   }
-  const id = randomUUID();
-  await client.execute({
-    sql: `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, description, url_allowlist, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-    args: [
-      id,
-      scope,
-      scopeId,
-      key,
-      encrypted,
-      description ?? null,
-      urlAllowlist ?? null,
-      now,
-      now,
-    ],
+
+  // SQLite: RETURNING support varies across better-sqlite3/libsql builds, so
+  // (matching the convention elsewhere in this codebase, e.g.
+  // integrations/pending-tasks-store.ts) re-read the id afterward instead of
+  // relying on it. The row is guaranteed to exist at this point, so this is
+  // a plain lookup rather than a TOCTOU-prone gate on the write itself.
+  await client.execute({ sql: upsertSql, args: upsertArgs });
+  const { rows } = await client.execute({
+    sql: `SELECT id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,
+    args: [scope, scopeId, key],
   });
-  return id;
+  return String(rows[0]?.id ?? id);
 }
 
 export interface ReadSecretResult {

package/corpus/core/src/server/action-discovery.ts

@@ -606,6 +606,10 @@ export async function mergeCoreSharingActions(
       () => import("../audit/actions/list-audit-events.js"),
     ],
     ["get-audit-event", () => import("../audit/actions/get-audit-event.js")],
+    [
+      "export-audit-events",
+      () => import("../audit/actions/export-audit-events.js"),
+    ],
     // History kit — reusable version snapshots and restore surface.
     [
       "create-resource-version",

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -8,6 +8,7 @@ import {
   getMethod,
   getQuery,
   getHeader,
+  getRequestIP,
   type H3Event,
 } from "h3";
 
@@ -19,7 +20,8 @@ import {
 } from "../a2a/artifact-response.js";
 import {
   hasConfiguredA2ASecret,
-  isA2AProductionRuntime,
+  isLoopbackAddress,
+  isTrustedLocalRuntime,
 } from "../a2a/auth-policy.js";
 import {
   applyAgentTextEventToBuffer,
@@ -1065,6 +1067,10 @@ function appStateKeyForBrowserTab(key: string, browserTabId: unknown): string {
  */
 const generateTitleRateLimit = new Map<string, number[]>();
 
+/** Only sweep drained rate-limit entries once the map grows past this size,
+ * so the common small-map case stays O(1). */
+const RATE_LIMIT_SWEEP_THRESHOLD = 1000;
+
 /**
  * Creates the `set-search-params` / `set-url-path` tools. Writes a one-shot
  * URL command to application_state; the client's URLSync component applies
@@ -6551,12 +6557,17 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
               setResponseStatus(event, 401);
               return { error: "Invalid or expired processor token" };
             }
-          } else if (isA2AProductionRuntime()) {
-            setResponseStatus(event, 503);
-            return {
-              error:
-                "Agent Teams processor not configured — set A2A_SECRET on this deployment.",
-            };
+          } else {
+            const loopback = isLoopbackAddress(
+              getRequestIP(event, { xForwardedFor: false }),
+            );
+            if (!isTrustedLocalRuntime({ loopback })) {
+              setResponseStatus(event, 503);
+              return {
+                error:
+                  "Agent Teams processor not configured — set A2A_SECRET on this deployment (or A2A_ALLOW_UNSIGNED_INTERNAL=1 for trusted local dev).",
+              };
+            }
           }
 
           try {
@@ -7224,6 +7235,11 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
           setResponseHeader(event, "Content-Type", "application/x-ndjson");
           setResponseHeader(event, "Cache-Control", "no-cache");
 
+          // Lets `cancel()` signal in-flight source work to stop early on
+          // client disconnect, instead of only being noticed the next time
+          // `flush()`'s `controller.enqueue` throws.
+          const mentionsAbort = new AbortController();
+
           const stream = new ReadableStream({
             start(controller) {
               return runWithRequestContext(
@@ -7235,7 +7251,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
               );
             },
             cancel() {
-              // Client disconnected — stop enqueuing
+              // Client disconnected — stop enqueuing and let in-flight source
+              // work short-circuit instead of running to completion unseen.
+              mentionsAbort.abort();
             },
           });
 
@@ -7246,10 +7264,13 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
           ) {
             const MAX_RESULTS = 50;
             let totalSent = 0;
-            let cancelled = false;
+            let cancelled = mentionsAbort.signal.aborted;
 
             const flush = (batch: MentionItemResponse[]) => {
-              if (cancelled) return;
+              if (cancelled || mentionsAbort.signal.aborted) {
+                cancelled = true;
+                return;
+              }
               const filtered = batch.filter(matchesQuery);
               if (filtered.length === 0) return;
               const remaining = MAX_RESULTS - totalSent;
@@ -7332,6 +7353,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
 
             // 3. Custom mention providers (each flushes independently)
             for (const [key, provider] of Object.entries(mentionProviders)) {
+              // Client already disconnected — don't spawn more provider work.
+              if (mentionsAbort.signal.aborted) break;
               sources.push(
                 (async () => {
                   try {
@@ -7419,7 +7442,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             );
 
             await Promise.all(sources);
-            if (!cancelled) controller.close();
+            if (!cancelled && !mentionsAbort.signal.aborted) {
+              controller.close();
+            }
           }
         }),
       );
@@ -7450,6 +7475,19 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
           recent.push(now);
           generateTitleRateLimit.set(ownerEmail, recent);
 
+          // Opportunistic eviction: keep the map from growing unbounded by
+          // the count of distinct users on a long-lived process. Drop any
+          // key whose window has fully drained (no timestamps within the
+          // rolling window).
+          if (generateTitleRateLimit.size > RATE_LIMIT_SWEEP_THRESHOLD) {
+            for (const [email, times] of generateTitleRateLimit) {
+              if (email === ownerEmail) continue;
+              if (times.every((t) => now - t >= limitWindowMs)) {
+                generateTitleRateLimit.delete(email);
+              }
+            }
+          }
+
           const body = await readBody(event);
           const message = body?.message;
           if (!message || typeof message !== "string") {
@@ -8438,10 +8476,14 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
 
           // Validate + HMAC-authenticate the self-dispatch and prepare the
           // background-worker body. Pure decision (unit-tested in
-          // durable-background.spec.ts); the route only wires it to h3.
+          // durable-background.spec.ts); the route only wires it to h3. This
+          // handler DOES have the h3 event, so it can see the real socket
+          // peer — thread the loopback signal through so unsigned local-dev
+          // self-dispatch (no A2A_SECRET) still works over 127.0.0.1/::1.
           const prepared = prepareProcessRunRequest(
             processBody,
             getHeader(event, "authorization"),
+            isLoopbackAddress(getRequestIP(event, { xForwardedFor: false })),
           );
           if (!prepared.ok) {
             // DIAGNOSTIC: record the auth/validation failure ONTO the run