@agent-native/core 0.96.0 → 0.97.0

package/corpus/core/src/server/core-routes-plugin.ts

@@ -1169,12 +1169,20 @@ export function createCoreRoutesPlugin(
         }),
       );
 
-      // Defense-in-depth CSRF check for state-changing /_agent-native/* routes.
-      // Mounted AFTER the CORS layer so disallowed-origin OPTIONS preflights
-      // 403 first (rather than being rejected on a stale cookie heuristic).
-      // See `csrf.ts` for the threat model and allowlist.
-      const { createCsrfMiddleware } = await import("./csrf.js");
-      getH3App(nitroApp).use(createCsrfMiddleware(P));
+      // Defense-in-depth CSRF check for state-changing /_agent-native/* routes
+      // (see `csrf.ts` for the threat model and allowlist) is registered by
+      // `getH3App()` itself (framework-request-handler.ts), synchronously, on
+      // the very first call to `getH3App(nitroApp)` for this process — NOT
+      // here. Registering it inside this plugin's own async init chain would
+      // race against agent-chat-plugin's action-route registration (a
+      // SEPARATE, independently-async-initialized Nitro plugin file in real
+      // deployments): whichever plugin's `getH3App(nitroApp).use(...)` call
+      // happened to resolve first would win the position in the middleware
+      // array, and CSRF losing that race would let an action route match and
+      // run before the CSRF check ever saw the request. Centralizing the
+      // registration in `getH3App()`'s one-time bootstrap makes it the first
+      // middleware any plugin's route can possibly land behind, regardless of
+      // plugin init ordering.
 
       // Agent discovery primitive — shared by headless CLI/A2A surfaces and
       // UI shells that need to show connected peer apps without depending on
@@ -1275,8 +1283,11 @@ export function createCoreRoutesPlugin(
             return { error: "executionId required" };
           }
 
-          const { hasConfiguredA2ASecret, isA2AProductionRuntime } =
-            await import("../a2a/auth-policy.js");
+          const {
+            hasConfiguredA2ASecret,
+            isLoopbackAddress,
+            isTrustedLocalRuntime,
+          } = await import("../a2a/auth-policy.js");
           if (hasConfiguredA2ASecret()) {
             const { verifyInternalToken, extractBearerToken } =
               await import("../integrations/internal-token.js");
@@ -1285,12 +1296,17 @@ export function createCoreRoutesPlugin(
               setResponseStatus(event, 401);
               return { error: "Invalid or expired processor token" };
             }
-          } else if (isA2AProductionRuntime()) {
-            setResponseStatus(event, 503);
-            return {
-              error:
-                "Sandbox execution processor not configured — set A2A_SECRET on this deployment.",
-            };
+          } else {
+            const loopback = isLoopbackAddress(
+              getRequestIP(event, { xForwardedFor: false }),
+            );
+            if (!isTrustedLocalRuntime({ loopback })) {
+              setResponseStatus(event, 503);
+              return {
+                error:
+                  "Sandbox execution processor not configured — set A2A_SECRET on this deployment (or A2A_ALLOW_UNSIGNED_INTERNAL=1 for trusted local dev).",
+              };
+            }
           }
 
           try {

package/corpus/core/src/server/csrf.ts

@@ -50,6 +50,8 @@ import {
   setResponseStatus,
 } from "h3";
 
+import { getConfiguredAppBasePath } from "./app-base-path.js";
+
 /**
  * Path prefixes (relative to the framework prefix `/_agent-native`) that are
  * allowed to receive cross-origin state-changing POSTs without first-party
@@ -144,9 +146,10 @@ function requestHasCookies(event: any): boolean {
 }
 
 /**
- * Path passed in is the full request URL pathname (e.g. `/_agent-native/actions/foo`).
- * `frameworkPrefix` should be the framework route prefix without trailing slash,
- * e.g. `/_agent-native`.
+ * The path is the full request URL pathname (e.g.
+ * `/_agent-native/actions/foo` or `/app/_agent-native/actions/foo`).
+ * `frameworkPrefix` is the root framework route prefix without a trailing
+ * slash, e.g. `/_agent-native`.
  */
 function isOnAllowlist(pathname: string, frameworkPrefix: string): boolean {
   if (!pathname.startsWith(frameworkPrefix)) return false;
@@ -157,6 +160,21 @@ function isOnAllowlist(pathname: string, frameworkPrefix: string): boolean {
   return false;
 }
 
+function matchingFrameworkPrefix(
+  pathname: string,
+  frameworkPrefix: string,
+): string | undefined {
+  if (pathname.startsWith(frameworkPrefix)) return frameworkPrefix;
+
+  const basePath = getConfiguredAppBasePath();
+  const basePathFrameworkPrefix = `${basePath}${frameworkPrefix}`;
+  if (basePath && pathname.startsWith(basePathFrameworkPrefix)) {
+    return basePathFrameworkPrefix;
+  }
+
+  return undefined;
+}
+
 /**
  * Create the framework CSRF middleware.
  *
@@ -176,8 +194,9 @@ export function createCsrfMiddleware(
     if (!STATE_CHANGING_METHODS.has(method)) return undefined;
 
     const pathname = event.url?.pathname ?? "";
-    if (!pathname.startsWith(frameworkPrefix)) return undefined;
-    if (isOnAllowlist(pathname, frameworkPrefix)) return undefined;
+    const matchingPrefix = matchingFrameworkPrefix(pathname, frameworkPrefix);
+    if (!matchingPrefix) return undefined;
+    if (isOnAllowlist(pathname, matchingPrefix)) return undefined;
 
     // No cookie = no risk of confused-deputy CSRF on the session cookie.
     if (!requestHasCookies(event)) return undefined;

package/corpus/core/src/server/framework-request-handler.ts

@@ -17,6 +17,7 @@ import { setResponseHeader, setResponseStatus } from "h3";
 import { getMissingDefaultPlugins } from "../deploy/route-discovery.js";
 import { getConfiguredAppBasePath } from "./app-base-path.js";
 import { captureError } from "./capture-error.js";
+import { createCsrfMiddleware } from "./csrf.js";
 
 const BOOTSTRAPPED = new WeakSet<object>();
 const IN_BOOTSTRAP = new WeakSet<object>();
@@ -164,6 +165,27 @@ export function getH3App(nitroApp: any): H3AppShim {
       prepend: true,
     });
 
+    // CSRF (see csrf.ts): registered here — synchronously, on the very
+    // first `getH3App()` call for this nitroApp — rather than inside
+    // createCoreRoutesPlugin's own async init chain. Real deployments mount
+    // core-routes and agent-chat as SEPARATE, independently-async-initialized
+    // Nitro plugin files with no explicit ordering between them; both
+    // eventually call `getH3App(nitroApp).use(...)` to register their own
+    // routes (CSRF, action routes) after their own async setup (DB reads,
+    // dynamic imports) resolves in unpredictable relative order. The
+    // readiness gate above only guarantees every tracked plugin has FINISHED
+    // registering by the time a gated request is released — it does NOT
+    // guarantee CSRF's registration call happens to `.push()` onto
+    // `~middleware` before an action route's does. If agent-chat's action
+    // route push happened to land first, that route would match and run
+    // before CSRF ever saw the request. Registering CSRF here instead makes
+    // it the first non-prepended middleware pushed onto the array for this
+    // nitroApp, full stop — every plugin's own route registrations reach
+    // `getH3App()` (and therefore run after this point) before they can
+    // register anything, regardless of which plugin's async chain resolves
+    // first.
+    registerMiddleware(nitroApp, "", createCsrfMiddleware());
+
     // Primary gate: Nitro bridges this `request` hook to h3's `config.onRequest`,
     // which h3 awaits BEFORE `handler()` snapshots middleware and resolves the
     // route. The middleware gate above runs too late on production dispatchers —
@@ -466,7 +488,18 @@ function registerMiddleware(
     let originalPathname: string | undefined;
     let originalEventPath: string | undefined;
     let hadEventPath = false;
+    // Only true once this specific middleware invocation has actually
+    // stripped a mount prefix (i.e. `path` was non-empty and matched).
+    // Global (`path === ""`) middleware never mutates event.path/pathname,
+    // so `restoreOriginalPath` must be a no-op for it — otherwise it would
+    // unconditionally `delete event.path` on every pass-through (hadEventPath
+    // defaults to false), corrupting the event for any middleware that runs
+    // later in the chain (a real bug: two or more global middlewares in
+    // sequence, e.g. security-headers + CORS + CSRF, would wipe event.path
+    // for everything downstream, including the final route handler).
+    let didStripPath = false;
     const restoreOriginalPath = () => {
+      if (!didStripPath) return;
       if (originalPathname !== undefined) {
         try {
           event.url.pathname = originalPathname;
@@ -502,6 +535,7 @@ function registerMiddleware(
       const eventAny = event as any;
       hadEventPath = "path" in eventAny;
       originalEventPath = eventAny.path;
+      didStripPath = true;
       try {
         originalPathname = event.url.pathname;
         // Save the full path in context so handlers that need the original URL

package/corpus/core/src/server/google-realtime-session.ts

@@ -3,7 +3,6 @@ import { readFile } from "node:fs/promises";
 import {
   defineEventHandler,
   getMethod,
-  getRequestHeader,
   readBody,
   setResponseStatus,
   type H3Event,
@@ -15,6 +14,7 @@ import { readAppSecret } from "../secrets/storage.js";
 import { getSession } from "./auth.js";
 import { resolveBuilderCredentials } from "./credential-provider.js";
 import { runWithRequestContext } from "./request-context.js";
+import { isSameOriginRequest } from "./request-origin.js";
 
 interface GoogleRealtimeSessionResponse {
   websocketUrl: string;
@@ -22,41 +22,6 @@ interface GoogleRealtimeSessionResponse {
   websocketProtocol?: string;
 }
 
-function isSameOriginRequest(event: H3Event): boolean {
-  const host = getRequestHeader(event, "host");
-  const origin = getRequestHeader(event, "origin");
-  if (origin && host) {
-    try {
-      const parsed = new URL(origin);
-      if (parsed.host === host) return true;
-      if (parsed.protocol === "tauri:" && parsed.hostname === "localhost") {
-        return true;
-      }
-      if (
-        (parsed.protocol === "http:" || parsed.protocol === "https:") &&
-        parsed.hostname === "tauri.localhost" &&
-        (host.startsWith("localhost:") || host.startsWith("127.0.0.1:"))
-      ) {
-        return true;
-      }
-      if (
-        parsed.protocol === "http:" &&
-        (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") &&
-        parsed.port === "1420" &&
-        (host.startsWith("localhost:") || host.startsWith("127.0.0.1:"))
-      ) {
-        return true;
-      }
-      return false;
-    } catch {
-      return false;
-    }
-  }
-  const fetchSite = getRequestHeader(event, "sec-fetch-site");
-  if (fetchSite) return fetchSite === "same-origin" || fetchSite === "none";
-  return true;
-}
-
 export async function resolveGoogleRealtimeCredentials(opts: {
   userEmail?: string | null;
   orgId?: string | null;

package/corpus/core/src/server/poll.ts

@@ -738,9 +738,31 @@ async function getDurableChangesSinceForUser(
   }
 
   try {
+    // Scope the fetch to rows that could ever be visible to this caller
+    // before paying to JSON.parse and visibility-check every deployment-wide
+    // event: deployment-global rows (no owner, no org), the caller's own
+    // rows, the caller's org's rows, and resource-scoped rows (owner/org
+    // don't gate those — access is decided below by
+    // `getChangeVisibilityForUser`'s access-aware branch, which can grant a
+    // non-owner sharee, so resource-scoped rows must still flow through that
+    // check regardless of who owns them). This lets Postgres/SQLite use the
+    // `sync_events_owner_version_idx` / `sync_events_org_version_idx` indexes
+    // instead of scanning every tenant's activity on every poll. The OR group
+    // is parenthesized so `version > ?` ANDs against the whole group, not
+    // just the first term. A caller with no org passes a null `orgId` bind
+    // param, which makes `org_id = ?` evaluate to no match for every row
+    // (including null-org rows) in both dialects — mirroring the
+    // `event.orgId && orgId` truthy check in `getChangeVisibilityForUser`.
     const result = await getDbExec().execute({
-      sql: `SELECT version, event_json FROM sync_events WHERE version > ? ORDER BY version ASC LIMIT ?`,
-      args: [since, DURABLE_READ_LIMIT + 1],
+      sql: `SELECT version, event_json FROM sync_events WHERE version > ?
+              AND (
+                (owner IS NULL AND org_id IS NULL)
+                OR owner = ?
+                OR org_id = ?
+                OR resource_type IS NOT NULL
+              )
+            ORDER BY version ASC LIMIT ?`,
+      args: [since, userEmail, orgId ?? null, DURABLE_READ_LIMIT + 1],
     });
     const events: ChangeEvent[] = [];
     let version = Math.max(_version, since);

package/corpus/core/src/server/realtime-voice.ts

@@ -26,6 +26,7 @@ import {
 } from "./credential-provider.js";
 import { getH3App } from "./framework-request-handler.js";
 import { runWithRequestContext } from "./request-context.js";
+import { isSameOriginRequest } from "./request-origin.js";
 
 export const REALTIME_VOICE_SESSION_PATH =
   "/_agent-native/realtime-voice/session";
@@ -301,6 +302,10 @@ function createSessionHandler(
 ) {
   return defineEventHandler(async (event: H3Event) => {
     if (getMethod(event) !== "POST") return invalidMethod(event);
+    if (!isSameOriginRequest(event)) {
+      setResponseStatus(event, 403);
+      return { error: "Cross-origin request rejected" };
+    }
     setResponseHeader(event, "Cache-Control", "no-store");
 
     const auth = await authenticateVoiceRequest(event, options);
@@ -529,6 +534,10 @@ function createToolHandler(
 ) {
   return defineEventHandler(async (event: H3Event) => {
     if (getMethod(event) !== "POST") return invalidMethod(event);
+    if (!isSameOriginRequest(event)) {
+      setResponseStatus(event, 403);
+      return { error: "Cross-origin request rejected" };
+    }
     setResponseHeader(event, "Cache-Control", "no-store");
 
     const auth = await authenticateVoiceRequest(event, options);

package/corpus/core/src/server/request-origin.ts

@@ -0,0 +1,63 @@
+import { getRequestHeader, type H3Event } from "h3";
+
+function isLoopbackHost(host: string): boolean {
+  return host.startsWith("localhost:") || host.startsWith("127.0.0.1:");
+}
+
+/**
+ * Reject cross-site POSTs. Cookies are `SameSite=None; Secure` over HTTPS so
+ * the browser would otherwise attach the session to a forged form submission
+ * from evil.com, causing us to spend provider credits on the user's behalf.
+ * Same-origin browsers always send `Origin` on POST; if it's missing we fall
+ * back to `Sec-Fetch-Site` so Safari's fetch-spec behavior still works.
+ */
+export function isSameOriginRequest(event: H3Event): boolean {
+  const host = getRequestHeader(event, "host");
+  const origin = getRequestHeader(event, "origin");
+  if (origin && host) {
+    try {
+      const parsed = new URL(origin);
+      const forwardedProto = getRequestHeader(event, "x-forwarded-proto");
+      const forwardedProtocol =
+        forwardedProto === "https" || forwardedProto === "http"
+          ? `${forwardedProto}:`
+          : null;
+      const matchesScheme = forwardedProtocol
+        ? parsed.protocol === forwardedProtocol
+        : parsed.protocol === "https:" ||
+          (parsed.protocol === "http:" && isLoopbackHost(host));
+      if (parsed.host === host && matchesScheme) return true;
+      // Tauri desktop dev serves the tray WebView from localhost:1420 while
+      // the app server lives on the template dev port. Production Tauri
+      // WebViews can also send a tauri://localhost origin. Trust that custom
+      // scheme, while limiting the web-scheme desktop origins below to a
+      // loopback app server so arbitrary websites still fail the CSRF check.
+      if (parsed.protocol === "tauri:" && parsed.hostname === "localhost") {
+        return true;
+      }
+      if (
+        (parsed.protocol === "http:" || parsed.protocol === "https:") &&
+        parsed.hostname === "tauri.localhost" &&
+        isLoopbackHost(host)
+      ) {
+        return true;
+      }
+      if (
+        parsed.protocol === "http:" &&
+        (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") &&
+        parsed.port === "1420" &&
+        isLoopbackHost(host)
+      ) {
+        return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+  const fetchSite = getRequestHeader(event, "sec-fetch-site");
+  if (fetchSite) return fetchSite === "same-origin" || fetchSite === "none";
+  // No Origin and no Sec-Fetch-Site: likely a non-browser client (curl,
+  // server-side) — safe to allow, CSRF requires a browser with ambient cookies.
+  return true;
+}

package/corpus/core/src/server/transcribe-voice.ts

@@ -20,7 +20,6 @@
 import {
   defineEventHandler,
   getMethod,
-  getRequestHeader,
   readMultipartFormData,
   setResponseStatus,
   type H3Event,
@@ -43,6 +42,7 @@ import {
   resolveSecret,
 } from "./credential-provider.js";
 import { runWithRequestContext } from "./request-context.js";
+import { isSameOriginRequest } from "./request-origin.js";
 
 const WHISPER_URL = "https://api.openai.com/v1/audio/transcriptions";
 const GROQ_URL = "https://api.groq.com/openai/v1/audio/transcriptions";
@@ -75,55 +75,6 @@ const BUILDER_GEMINI_TRANSCRIPTION_MODEL = "gemini-3-1-flash-lite";
 const GEMINI_MODEL = "gemini-2.0-flash-lite";
 const GEMINI_URL = `https://generativelanguage.googleapis.com/v1beta/models/${GEMINI_MODEL}:generateContent`;
 
-/**
- * Reject cross-site POSTs. Cookies are `SameSite=None; Secure` over HTTPS so
- * the browser would otherwise attach the session to a forged form submission
- * from evil.com, causing us to spend OpenAI credits on the user's behalf.
- * Same-origin browsers always send `Origin` on POST; if it's missing we fall
- * back to `Sec-Fetch-Site` so Safari's fetch-spec behavior still works.
- */
-function isSameOriginRequest(event: H3Event): boolean {
-  const host = getRequestHeader(event, "host");
-  const origin = getRequestHeader(event, "origin");
-  if (origin && host) {
-    try {
-      const parsed = new URL(origin);
-      if (parsed.host === host) return true;
-      // Tauri desktop dev serves the tray WebView from localhost:1420 while
-      // the app server lives on the template dev port. Production Tauri
-      // WebViews can also send a tauri://localhost origin. Treat only those
-      // desktop origins as trusted cross-origin callers; arbitrary websites
-      // still fail the CSRF check.
-      if (parsed.protocol === "tauri:" && parsed.hostname === "localhost") {
-        return true;
-      }
-      if (
-        (parsed.protocol === "http:" || parsed.protocol === "https:") &&
-        parsed.hostname === "tauri.localhost" &&
-        (host.startsWith("localhost:") || host.startsWith("127.0.0.1:"))
-      ) {
-        return true;
-      }
-      if (
-        parsed.protocol === "http:" &&
-        (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") &&
-        parsed.port === "1420" &&
-        (host.startsWith("localhost:") || host.startsWith("127.0.0.1:"))
-      ) {
-        return true;
-      }
-      return false;
-    } catch {
-      return false;
-    }
-  }
-  const fetchSite = getRequestHeader(event, "sec-fetch-site");
-  if (fetchSite) return fetchSite === "same-origin" || fetchSite === "none";
-  // No Origin and no Sec-Fetch-Site: likely a non-browser client (curl,
-  // server-side) — safe to allow, CSRF requires a browser with ambient cookies.
-  return true;
-}
-
 /**
  * Derive an AbortSignal that fires when the client disconnects mid-request
  * (e.g. the desktop client's own 8s ceiling firing before a provider call's

package/corpus/core/src/templates/default/package.json

@@ -7,6 +7,7 @@
     "build": "agent-native build",
     "start": "agent-native start",
     "typecheck": "agent-native typecheck",
+    "doctor": "agent-native doctor",
     "action": "agent-native action",
     "script": "agent-native script",
     "skills:update": "agent-native skills update scaffold --project",
@@ -43,8 +44,7 @@
     "tailwind-merge": "^3.5.0",
     "tailwindcss": "^4.1.18",
     "tsx": "^4.20.3",
-    "typescript": "catalog:",
     "typescript-7": "catalog:",
-    "vite": "^8.0.0"
+    "vite": "8.1.0"
   }
 }

package/corpus/core/src/templates/headless/package.json

@@ -19,7 +19,6 @@
     "@types/node": "^24.2.1",
     "oxfmt": "catalog:",
     "tsx": "^4.20.3",
-    "typescript": "catalog:",
     "typescript-7": "catalog:"
   }
 }

package/corpus/core/src/templates/workspace-core/.agents/skills/audit-log/SKILL.md

@@ -77,6 +77,9 @@ SQL to the caller — they never leak another tenant's rows:
   (`agent` | `human` | `system`), `status`, `threadId`/`turnId`, `action`,
   `sinceMs`, `limit`.
 - `get-audit-event` — one event by id, with its redacted input payload.
+- `export-audit-events` — bulk CSV/NDJSON export (same filters minus `limit`,
+  plus `format` and `maxRows`) for offline/compliance pulls; itself audited
+  via `onRead`.
 
 Call them from the UI with `useActionQuery` to build an activity feed or a
 "who changed this" line — never hand-write a fetch to the audit table.

package/corpus/core/src/templates/workspace-core/.agents/skills/automations/SKILL.md

@@ -61,7 +61,7 @@ Use the web-request tool with ${keys.SLACK_WEBHOOK}.
 | `triggerType` | `"schedule" \| "event"`        | How the automation fires                               |
 | `event`       | `string?`                      | Event name to subscribe to (event triggers)            |
 | `condition`   | `string?`                      | Natural-language condition evaluated before dispatch   |
-| `mode`        | `"agentic" \| "deterministic"` | Full agent loop vs. fixed action set                   |
+| `mode`        | `"agentic"`                    | Full agent loop (only supported mode; `"deterministic"` was removed — never implemented, rejected at define time) |
 | `model`       | `string?`                      | Override the model for this trigger's agent loop       |
 | `domain`      | `string?`                      | Grouping tag (mail, calendar, clips, etc.)             |
 | `createdBy`   | `string?`                      | Owner email                                            |

package/corpus/core/src/templates/workspace-core/package.json

@@ -32,7 +32,6 @@
     "prepare": "tsc"
   },
   "devDependencies": {
-    "typescript": "catalog:",
     "typescript-7": "catalog:"
   }
 }

package/corpus/core/src/templates/workspace-root/package.json

@@ -20,7 +20,6 @@
     "@types/node": "^24.2.1",
     "oxfmt": "catalog:",
     "tsx": "catalog:",
-    "typescript": "catalog:",
     "typescript-7": "catalog:"
   },
   "packageManager": "pnpm@10.14.0",

package/corpus/core/src/triggers/actions.ts

@@ -107,6 +107,14 @@ async function handleDefine(
     return `Error: An automation named "${name}" already exists. Use a different name or delete the existing one first.`;
   }
 
+  if (args.mode === "deterministic") {
+    return (
+      "Error: Deterministic mode was removed — it was never implemented and " +
+      "automations that set it never fired. Create the automation without " +
+      "mode (agentic), and describe the exact fixed steps in the automation body."
+    );
+  }
+
   const triggerType = args.trigger_type === "schedule" ? "schedule" : "event";
   const meta: TriggerFrontmatter = {
     schedule: args.schedule || "",
@@ -114,7 +122,7 @@ async function handleDefine(
     triggerType,
     event: args.event || undefined,
     condition: args.condition || undefined,
-    mode: args.mode === "deterministic" ? "deterministic" : "agentic",
+    mode: "agentic",
     domain: args.domain || undefined,
     createdBy: owner,
     runAs: "creator",
@@ -268,8 +276,8 @@ export function createAutomationToolEntries(
             mode: {
               type: "string",
               description:
-                '"agentic" (full agent loop, can use tools) or "deterministic" (fixed actions only). Used by define.',
-              enum: ["agentic", "deterministic"],
+                '"agentic" (full agent loop, can use tools) — the only supported mode. Used by define.',
+              enum: ["agentic"],
             },
             domain: {
               type: "string",

package/corpus/core/src/triggers/types.ts

@@ -15,7 +15,13 @@ export interface TriggerFrontmatter {
   event?: string;
   /** Natural-language condition evaluated by Haiku before dispatch. */
   condition?: string;
-  /** "agentic" = full runAgentLoop. "deterministic" = fixed action set. */
+  /**
+   * "agentic" = full runAgentLoop; the only mode `manage-automations` will
+   * define/update going forward. "deterministic" was removed from the
+   * advertised surface (never implemented) and is legacy-only: rows created
+   * before the removal may still carry it, and the dispatcher's
+   * warn-and-skip branch keeps them inert by design — do not make them fire.
+   */
   mode: "agentic" | "deterministic";
   /** Domain tag for filtering in per-template UIs. */
   domain?: string;