@agent-native/core 0.96.0 → 0.98.0

package/corpus/core/src/server/agent-teams.ts

@@ -23,7 +23,10 @@ import type {
   ActionEntry,
   AgentLoopFinalResponseGuard,
 } from "../agent/production-agent.js";
-import { actionsToEngineTools } from "../agent/production-agent.js";
+import {
+  actionsToEngineTools,
+  filterInitialEngineTools,
+} from "../agent/production-agent.js";
 import {
   runAgentLoop,
   appendAgentLoopContinuation,
@@ -43,6 +46,7 @@ import {
   foldAssistantTurn,
   threadDataToEngineMessages,
 } from "../agent/thread-data-builder.js";
+import { attachToolSearch } from "../agent/tool-search.js";
 import type { AgentChatEvent } from "../agent/types.js";
 import type { RunEvent } from "../agent/types.js";
 import {
@@ -1600,6 +1604,16 @@ export interface AgentTeamRunConfig {
   actions: Record<string, ActionEntry>;
   engine: AgentEngine;
   model: string;
+  /**
+   * Tool names to expose on the FIRST engine request for this sub-agent
+   * chunk. See `SchedulerDeps.getInitialToolNames` (`jobs/scheduler.ts`) —
+   * same semantics: when provided, every other action in `actions` is
+   * deferred behind an attached `tool-search` entry instead of being
+   * serialized on every chunk; `runAgentLoop`'s mid-run tool expansion still
+   * lets the model discover and call them after a search. Omit to keep the
+   * full `actions` set visible up front (current behavior).
+   */
+  initialToolNames?: string[];
 }
 
 export interface ProcessAgentTeamRunOptions {
@@ -1710,11 +1724,19 @@ export async function processAgentTeamRun(
         ];
       }
 
+      const initialToolNames = config.initialToolNames;
+      // Only attach tool-search (and pay its schema cost) when the caller
+      // actually supplied an initial subset to filter down to — otherwise
+      // this is byte-for-byte the prior unfiltered behavior.
+      const baseActions = initialToolNames
+        ? attachToolSearch({ ...config.actions })
+        : config.actions;
       const messageAwareActions = createMessageAwareActions(
         opts.taskId,
-        config.actions,
+        baseActions,
       );
-      const tools = actionsToEngineTools(messageAwareActions);
+      const availableTools = actionsToEngineTools(messageAwareActions);
+      const tools = filterInitialEngineTools(availableTools, initialToolNames);
 
       // Fresh runId per chunk (avoids agent_runs PK collisions); stable turnId so
       // the durable assistant message folds across chunks.
@@ -1815,6 +1837,7 @@ export async function processAgentTeamRun(
                     model: config.model,
                     systemPrompt,
                     tools,
+                    availableTools,
                     messages,
                     actions: messageAwareActions,
                     send: wrappedSend,

package/corpus/core/src/server/auth.ts

@@ -1860,56 +1860,38 @@ function createAuthGuardFn(): (
     }
 
     // Force-sign-in entrypoint. Templates send viewers from public pages
-    // (share links, embeds) here with a `?return=<path>` query — anonymous
-    // visitors get the loginHtml, and once they sign in the loginHtml's
-    // post-login reload re-hits this same URL with a session cookie set,
-    // so we 302 them to the original page.
-    //
-    // `return` is validated by parsing it against a sentinel base origin
-    // and checking the resolved origin still matches. This rejects every
-    // open-redirect shape — `//evil.com/...` (network-path reference),
-    // `/\evil.com/...` (WHATWG URL parser normalises `\` to `/` in HTTP
-    // URLs, so a naive prefix check on `//` misses this), absolute URLs
-    // like `https://evil.com`, and `data:` / `javascript:` schemes. The
-    // reconstructed path comes from the parsed segments so any leftover
-    // quirks get normalised. Control chars (incl. CR/LF for header
-    // injection) are rejected up front.
-    //
+    // (share links, embeds) here with a `?return=<path>` query. The cached
+    // login document validates that return path in the browser and redirects
+    // there after sign-in or when its client-side session check finds an
+    // existing session.
     if (p === "/_agent-native/sign-in") {
-      const queryStr = queryStart >= 0 ? url.slice(queryStart + 1) : "";
-      const safeReturn = safeReturnPath(
-        new URLSearchParams(queryStr).get("return"),
-      );
-      const session = await getSession(event);
-      if (session) {
-        return new Response("", {
-          status: 302,
-          headers: { Location: safeReturn },
-        });
-      }
-      return loginHtmlResponse(loginHtml, event);
-    }
-
-    // Auth entry pages are framework-owned pages, not app routes. When a user
-    // already has a session, redirect them back to the mounted app instead of
-    // letting React Router try to render /login.
-    if (p === "/login" || p === "/signup") {
-      const session = await getSession(event);
-      if (session) {
+      // Preserve the zero-setup localhost experience without putting a
+      // session lookup back on the cacheable app-shell URL. The client gate
+      // reaches this explicit entrypoint after discovering there is no
+      // session; only a fresh local development DB can take this redirect.
+      if (getMethod(event) === "GET") {
         const queryStr = queryStart >= 0 ? url.slice(queryStart + 1) : "";
         const safeReturn = safeReturnPath(
           new URLSearchParams(queryStr).get("return"),
         );
-        return new Response("", {
-          status: 302,
-          headers: {
-            Location: safeReturn === "/" ? getAppBasePath() || "/" : safeReturn,
-          },
-        });
+        const autoSession = await maybeAutoCreateDevSession(
+          event,
+          safeReturn === "/" ? getAppBasePath() || "/" : safeReturn,
+        );
+        if (autoSession) return autoSession;
       }
       return loginHtmlResponse(loginHtml, event);
     }
 
+    // Auth entry pages are framework-owned pages, not app routes. Always serve
+    // the same public, cacheable login document here. Its client-side session
+    // check redirects signed-in visitors to the validated return path. Keeping
+    // session-dependent decisions out of this server response prevents the CDN
+    // from caching two different representations for the same URL.
+    if (p === "/login" || p === "/signup") {
+      return loginHtmlResponse(loginHtml, event);
+    }
+
     // Skip static assets (Vite chunks, fonts, images, etc.)
     if (
       p.startsWith("/assets/") ||
@@ -1950,6 +1932,36 @@ function createAuthGuardFn(): (
       return;
     }
 
+    // Normal app documents and React Router page-data requests are an
+    // impersonal SSR shell. `createH3SSRHandler` renders both under an
+    // explicitly anonymous request context and gives them one shared public
+    // cache policy, so production requests must not vary either response by
+    // cookie. `AppProviders` resolves the browser session and gates private UI
+    // after hydration.
+    const isAppPageRequest =
+      p !== "/api" &&
+      !p.startsWith("/api/") &&
+      p !== "/_agent-native" &&
+      !p.startsWith("/_agent-native/") &&
+      (isHtmlDocumentRequest(event, p) ||
+        (isReadMethod(event) && p.endsWith(".data")));
+    if (isAppPageRequest) {
+      // A freshly scaffolded, loopback-only development app needs its initial
+      // session before Vite starts optimizing and potentially reloading the
+      // client. Waiting for the hydrated client gate to reach sign-in can lose
+      // that one-time redirect after the dev account is created, leaving the
+      // browser at the login page with no way to recreate its random password.
+      // `maybeAutoCreateDevSession` is strictly development + loopback scoped,
+      // does not read an existing session, and returns null for every existing
+      // dev account, so production SSR remains one cacheable anonymous shell
+      // and explicit sign-out still works.
+      if (getMethod(event) === "GET") {
+        const autoSession = await maybeAutoCreateDevSession(event, url);
+        if (autoSession) return autoSession;
+      }
+      return;
+    }
+
     const session = await getSession(event);
     if (session) return;
 
@@ -1958,22 +1970,8 @@ function createAuthGuardFn(): (
       return { error: "Unauthorized" };
     }
 
-    if (!isHtmlDocumentRequest(event, p)) {
-      setResponseStatus(event, 401);
-      return { error: "Unauthorized" };
-    }
-
-    // Local-dev convenience: on the first page GET of a freshly-scaffolded
-    // app, transparently create + sign in `dev@local.test` instead of
-    // showing the sign-up form. Gated on NODE_ENV=development AND no real users in the
-    // DB, so production and any app that has ever had a real signup are
-    // unaffected. See maybeAutoCreateDevSession for full conditions.
-    if (getMethod(event) === "GET") {
-      const autoSession = await maybeAutoCreateDevSession(event, url);
-      if (autoSession) return autoSession;
-    }
-
-    return loginHtmlResponse(loginHtml, event);
+    setResponseStatus(event, 401);
+    return { error: "Unauthorized" };
   };
 }
 

package/corpus/core/src/server/core-routes-plugin.ts

@@ -1169,12 +1169,20 @@ export function createCoreRoutesPlugin(
         }),
       );
 
-      // Defense-in-depth CSRF check for state-changing /_agent-native/* routes.
-      // Mounted AFTER the CORS layer so disallowed-origin OPTIONS preflights
-      // 403 first (rather than being rejected on a stale cookie heuristic).
-      // See `csrf.ts` for the threat model and allowlist.
-      const { createCsrfMiddleware } = await import("./csrf.js");
-      getH3App(nitroApp).use(createCsrfMiddleware(P));
+      // Defense-in-depth CSRF check for state-changing /_agent-native/* routes
+      // (see `csrf.ts` for the threat model and allowlist) is registered by
+      // `getH3App()` itself (framework-request-handler.ts), synchronously, on
+      // the very first call to `getH3App(nitroApp)` for this process — NOT
+      // here. Registering it inside this plugin's own async init chain would
+      // race against agent-chat-plugin's action-route registration (a
+      // SEPARATE, independently-async-initialized Nitro plugin file in real
+      // deployments): whichever plugin's `getH3App(nitroApp).use(...)` call
+      // happened to resolve first would win the position in the middleware
+      // array, and CSRF losing that race would let an action route match and
+      // run before the CSRF check ever saw the request. Centralizing the
+      // registration in `getH3App()`'s one-time bootstrap makes it the first
+      // middleware any plugin's route can possibly land behind, regardless of
+      // plugin init ordering.
 
       // Agent discovery primitive — shared by headless CLI/A2A surfaces and
       // UI shells that need to show connected peer apps without depending on
@@ -1275,8 +1283,11 @@ export function createCoreRoutesPlugin(
             return { error: "executionId required" };
           }
 
-          const { hasConfiguredA2ASecret, isA2AProductionRuntime } =
-            await import("../a2a/auth-policy.js");
+          const {
+            hasConfiguredA2ASecret,
+            isLoopbackAddress,
+            isTrustedLocalRuntime,
+          } = await import("../a2a/auth-policy.js");
           if (hasConfiguredA2ASecret()) {
             const { verifyInternalToken, extractBearerToken } =
               await import("../integrations/internal-token.js");
@@ -1285,12 +1296,17 @@ export function createCoreRoutesPlugin(
               setResponseStatus(event, 401);
               return { error: "Invalid or expired processor token" };
             }
-          } else if (isA2AProductionRuntime()) {
-            setResponseStatus(event, 503);
-            return {
-              error:
-                "Sandbox execution processor not configured — set A2A_SECRET on this deployment.",
-            };
+          } else {
+            const loopback = isLoopbackAddress(
+              getRequestIP(event, { xForwardedFor: false }),
+            );
+            if (!isTrustedLocalRuntime({ loopback })) {
+              setResponseStatus(event, 503);
+              return {
+                error:
+                  "Sandbox execution processor not configured — set A2A_SECRET on this deployment (or A2A_ALLOW_UNSIGNED_INTERNAL=1 for trusted local dev).",
+              };
+            }
           }
 
           try {

package/corpus/core/src/server/credential-provider.ts

@@ -257,30 +257,27 @@ export function isBuilderPrivateKey(value: string | null | undefined): boolean {
 }
 
 async function readBuilderCredentialScope(
-  readAppSecret: typeof import("../secrets/storage.js").readAppSecret,
+  readAppSecrets: typeof import("../secrets/storage.js").readAppSecrets,
   scope: "user" | "org" | "workspace",
   scopeId: string,
 ): Promise<BuilderResolvedCredentials> {
-  const values = await Promise.all(
-    BUILDER_CREDENTIAL_KEYS.map(async (key) => {
-      const secret = await readAppSecret({ key, scope, scopeId });
-      return [key, secret?.value ?? null] as const;
-    }),
-  );
-  const map = new Map<string, string | null>(values);
+  const secrets = await readAppSecrets({
+    keys: BUILDER_CREDENTIAL_KEYS,
+    scope,
+    scopeId,
+  });
+  const value = (key: string): string | null => secrets.get(key)?.value ?? null;
   return {
-    privateKey: map.get("BUILDER_PRIVATE_KEY") ?? null,
-    publicKey: map.get("BUILDER_PUBLIC_KEY") ?? null,
-    userId: map.get("BUILDER_USER_ID") ?? null,
-    orgName: map.get("BUILDER_ORG_NAME") ?? null,
-    orgKind: map.get("BUILDER_ORG_KIND") ?? null,
-    subscription: map.get("BUILDER_SUBSCRIPTION") ?? null,
-    subscriptionLevel: map.get("BUILDER_SUBSCRIPTION_LEVEL") ?? null,
-    subscriptionName: map.get("BUILDER_SUBSCRIPTION_NAME") ?? null,
-    isEnterprise: readOptionalBuilderBoolean(map.get("BUILDER_IS_ENTERPRISE")),
-    isFreeAccount: readOptionalBuilderBoolean(
-      map.get("BUILDER_IS_FREE_ACCOUNT"),
-    ),
+    privateKey: value("BUILDER_PRIVATE_KEY"),
+    publicKey: value("BUILDER_PUBLIC_KEY"),
+    userId: value("BUILDER_USER_ID"),
+    orgName: value("BUILDER_ORG_NAME"),
+    orgKind: value("BUILDER_ORG_KIND"),
+    subscription: value("BUILDER_SUBSCRIPTION"),
+    subscriptionLevel: value("BUILDER_SUBSCRIPTION_LEVEL"),
+    subscriptionName: value("BUILDER_SUBSCRIPTION_NAME"),
+    isEnterprise: readOptionalBuilderBoolean(value("BUILDER_IS_ENTERPRISE")),
+    isFreeAccount: readOptionalBuilderBoolean(value("BUILDER_IS_FREE_ACCOUNT")),
     source: scope === "workspace" ? "workspace" : scope,
   };
 }
@@ -397,7 +394,7 @@ async function resolveScopedBuilderCredentials(): Promise<BuilderResolvedCredent
   const traceLookup = shouldTraceCredentialResolve();
   let scopeAttempted = "user";
   try {
-    const { readAppSecret } = await import("../secrets/storage.js");
+    const { readAppSecrets } = await import("../secrets/storage.js");
     const traceScope = (creds: BuilderResolvedCredentials, scopeId: string) => {
       if (!traceLookup) return;
       console.log(
@@ -406,7 +403,7 @@ async function resolveScopedBuilderCredentials(): Promise<BuilderResolvedCredent
     };
 
     const userCreds = await readBuilderCredentialScope(
-      readAppSecret,
+      readAppSecrets,
       "user",
       email,
     );
@@ -417,7 +414,7 @@ async function resolveScopedBuilderCredentials(): Promise<BuilderResolvedCredent
     if (orgId) {
       scopeAttempted = "org";
       const orgCreds = await readBuilderCredentialScope(
-        readAppSecret,
+        readAppSecrets,
         "org",
         orgId,
       );
@@ -426,7 +423,7 @@ async function resolveScopedBuilderCredentials(): Promise<BuilderResolvedCredent
 
       scopeAttempted = "workspace";
       const workspaceCreds = await readBuilderCredentialScope(
-        readAppSecret,
+        readAppSecrets,
         "workspace",
         orgId,
       );
@@ -436,7 +433,7 @@ async function resolveScopedBuilderCredentials(): Promise<BuilderResolvedCredent
       scopeAttempted = "workspace-solo";
       const scopeId = `solo:${email}`;
       const workspaceCreds = await readBuilderCredentialScope(
-        readAppSecret,
+        readAppSecrets,
         "workspace",
         scopeId,
       );

package/corpus/core/src/server/csrf.ts

@@ -50,6 +50,8 @@ import {
   setResponseStatus,
 } from "h3";
 
+import { getConfiguredAppBasePath } from "./app-base-path.js";
+
 /**
  * Path prefixes (relative to the framework prefix `/_agent-native`) that are
  * allowed to receive cross-origin state-changing POSTs without first-party
@@ -144,9 +146,10 @@ function requestHasCookies(event: any): boolean {
 }
 
 /**
- * Path passed in is the full request URL pathname (e.g. `/_agent-native/actions/foo`).
- * `frameworkPrefix` should be the framework route prefix without trailing slash,
- * e.g. `/_agent-native`.
+ * The path is the full request URL pathname (e.g.
+ * `/_agent-native/actions/foo` or `/app/_agent-native/actions/foo`).
+ * `frameworkPrefix` is the root framework route prefix without a trailing
+ * slash, e.g. `/_agent-native`.
  */
 function isOnAllowlist(pathname: string, frameworkPrefix: string): boolean {
   if (!pathname.startsWith(frameworkPrefix)) return false;
@@ -157,6 +160,21 @@ function isOnAllowlist(pathname: string, frameworkPrefix: string): boolean {
   return false;
 }
 
+function matchingFrameworkPrefix(
+  pathname: string,
+  frameworkPrefix: string,
+): string | undefined {
+  if (pathname.startsWith(frameworkPrefix)) return frameworkPrefix;
+
+  const basePath = getConfiguredAppBasePath();
+  const basePathFrameworkPrefix = `${basePath}${frameworkPrefix}`;
+  if (basePath && pathname.startsWith(basePathFrameworkPrefix)) {
+    return basePathFrameworkPrefix;
+  }
+
+  return undefined;
+}
+
 /**
  * Create the framework CSRF middleware.
  *
@@ -176,8 +194,9 @@ export function createCsrfMiddleware(
     if (!STATE_CHANGING_METHODS.has(method)) return undefined;
 
     const pathname = event.url?.pathname ?? "";
-    if (!pathname.startsWith(frameworkPrefix)) return undefined;
-    if (isOnAllowlist(pathname, frameworkPrefix)) return undefined;
+    const matchingPrefix = matchingFrameworkPrefix(pathname, frameworkPrefix);
+    if (!matchingPrefix) return undefined;
+    if (isOnAllowlist(pathname, matchingPrefix)) return undefined;
 
     // No cookie = no risk of confused-deputy CSRF on the session cookie.
     if (!requestHasCookies(event)) return undefined;

package/corpus/core/src/server/edge.ts

@@ -66,3 +66,4 @@ export {
   markDefaultPluginProvided,
   type H3AppShim,
 } from "./framework-request-handler.js";
+export { runWithRequestContext } from "./request-context.js";

package/corpus/core/src/server/framework-request-handler.ts

@@ -17,6 +17,7 @@ import { setResponseHeader, setResponseStatus } from "h3";
 import { getMissingDefaultPlugins } from "../deploy/route-discovery.js";
 import { getConfiguredAppBasePath } from "./app-base-path.js";
 import { captureError } from "./capture-error.js";
+import { createCsrfMiddleware } from "./csrf.js";
 
 const BOOTSTRAPPED = new WeakSet<object>();
 const IN_BOOTSTRAP = new WeakSet<object>();
@@ -164,6 +165,27 @@ export function getH3App(nitroApp: any): H3AppShim {
       prepend: true,
     });
 
+    // CSRF (see csrf.ts): registered here — synchronously, on the very
+    // first `getH3App()` call for this nitroApp — rather than inside
+    // createCoreRoutesPlugin's own async init chain. Real deployments mount
+    // core-routes and agent-chat as SEPARATE, independently-async-initialized
+    // Nitro plugin files with no explicit ordering between them; both
+    // eventually call `getH3App(nitroApp).use(...)` to register their own
+    // routes (CSRF, action routes) after their own async setup (DB reads,
+    // dynamic imports) resolves in unpredictable relative order. The
+    // readiness gate above only guarantees every tracked plugin has FINISHED
+    // registering by the time a gated request is released — it does NOT
+    // guarantee CSRF's registration call happens to `.push()` onto
+    // `~middleware` before an action route's does. If agent-chat's action
+    // route push happened to land first, that route would match and run
+    // before CSRF ever saw the request. Registering CSRF here instead makes
+    // it the first non-prepended middleware pushed onto the array for this
+    // nitroApp, full stop — every plugin's own route registrations reach
+    // `getH3App()` (and therefore run after this point) before they can
+    // register anything, regardless of which plugin's async chain resolves
+    // first.
+    registerMiddleware(nitroApp, "", createCsrfMiddleware());
+
     // Primary gate: Nitro bridges this `request` hook to h3's `config.onRequest`,
     // which h3 awaits BEFORE `handler()` snapshots middleware and resolves the
     // route. The middleware gate above runs too late on production dispatchers —
@@ -466,7 +488,18 @@ function registerMiddleware(
     let originalPathname: string | undefined;
     let originalEventPath: string | undefined;
     let hadEventPath = false;
+    // Only true once this specific middleware invocation has actually
+    // stripped a mount prefix (i.e. `path` was non-empty and matched).
+    // Global (`path === ""`) middleware never mutates event.path/pathname,
+    // so `restoreOriginalPath` must be a no-op for it — otherwise it would
+    // unconditionally `delete event.path` on every pass-through (hadEventPath
+    // defaults to false), corrupting the event for any middleware that runs
+    // later in the chain (a real bug: two or more global middlewares in
+    // sequence, e.g. security-headers + CORS + CSRF, would wipe event.path
+    // for everything downstream, including the final route handler).
+    let didStripPath = false;
     const restoreOriginalPath = () => {
+      if (!didStripPath) return;
       if (originalPathname !== undefined) {
         try {
           event.url.pathname = originalPathname;
@@ -502,6 +535,7 @@ function registerMiddleware(
       const eventAny = event as any;
       hadEventPath = "path" in eventAny;
       originalEventPath = eventAny.path;
+      didStripPath = true;
       try {
         originalPathname = event.url.pathname;
         // Save the full path in context so handlers that need the original URL

package/corpus/core/src/server/google-realtime-session.ts

@@ -3,7 +3,6 @@ import { readFile } from "node:fs/promises";
 import {
   defineEventHandler,
   getMethod,
-  getRequestHeader,
   readBody,
   setResponseStatus,
   type H3Event,
@@ -15,6 +14,7 @@ import { readAppSecret } from "../secrets/storage.js";
 import { getSession } from "./auth.js";
 import { resolveBuilderCredentials } from "./credential-provider.js";
 import { runWithRequestContext } from "./request-context.js";
+import { isSameOriginRequest } from "./request-origin.js";
 
 interface GoogleRealtimeSessionResponse {
   websocketUrl: string;
@@ -22,41 +22,6 @@ interface GoogleRealtimeSessionResponse {
   websocketProtocol?: string;
 }
 
-function isSameOriginRequest(event: H3Event): boolean {
-  const host = getRequestHeader(event, "host");
-  const origin = getRequestHeader(event, "origin");
-  if (origin && host) {
-    try {
-      const parsed = new URL(origin);
-      if (parsed.host === host) return true;
-      if (parsed.protocol === "tauri:" && parsed.hostname === "localhost") {
-        return true;
-      }
-      if (
-        (parsed.protocol === "http:" || parsed.protocol === "https:") &&
-        parsed.hostname === "tauri.localhost" &&
-        (host.startsWith("localhost:") || host.startsWith("127.0.0.1:"))
-      ) {
-        return true;
-      }
-      if (
-        parsed.protocol === "http:" &&
-        (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") &&
-        parsed.port === "1420" &&
-        (host.startsWith("localhost:") || host.startsWith("127.0.0.1:"))
-      ) {
-        return true;
-      }
-      return false;
-    } catch {
-      return false;
-    }
-  }
-  const fetchSite = getRequestHeader(event, "sec-fetch-site");
-  if (fetchSite) return fetchSite === "same-origin" || fetchSite === "none";
-  return true;
-}
-
 export async function resolveGoogleRealtimeCredentials(opts: {
   userEmail?: string | null;
   orgId?: string | null;

package/corpus/core/src/server/onboarding-html.ts

@@ -15,7 +15,6 @@ import {
   SUPPORTED_LOCALES,
   type LocaleCode,
 } from "../localization/shared.js";
-import { AUTH_REDIRECT_QUERY_PARAM } from "../shared/auth-redirect-url.js";
 import {
   AGENT_NATIVE_SOCIAL_IMAGE_ALT,
   AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT,
@@ -2917,22 +2916,8 @@ ${signupLocalModeNoteHtml}
       if (__anIsAuthEntryPath(window.location.pathname)) return __anPath('/');
       return __anCurrentReturnPath();
     }
-    function __anWithAuthCacheBypass(ret) {
-      try {
-        var url = new URL(ret || __anPath('/'), window.location.origin);
-        url.searchParams.set('${AUTH_REDIRECT_QUERY_PARAM}', Date.now().toString(36));
-        return url.pathname + url.search + url.hash;
-      } catch(e) {
-        var fallback = ret || __anPath('/');
-        var hashIndex = fallback.indexOf('#');
-        var beforeHash = hashIndex === -1 ? fallback : fallback.slice(0, hashIndex);
-        var hash = hashIndex === -1 ? '' : fallback.slice(hashIndex);
-        var sep = beforeHash.indexOf('?') === -1 ? '?' : '&';
-        return beforeHash + sep + '${AUTH_REDIRECT_QUERY_PARAM}=' + Date.now().toString(36) + hash;
-      }
-    }
     function __anRedirectToSignedInApp(ret) {
-      window.location.replace(__anWithAuthCacheBypass(ret || __anGetSignedInReturnPath()));
+      window.location.replace(ret || __anGetSignedInReturnPath());
     }
     function __anMaybeRedirectSignedIn(ret) {
       return fetch(__anPath('/_agent-native/auth/session'), {

package/corpus/core/src/server/poll.ts

@@ -738,9 +738,31 @@ async function getDurableChangesSinceForUser(
   }
 
   try {
+    // Scope the fetch to rows that could ever be visible to this caller
+    // before paying to JSON.parse and visibility-check every deployment-wide
+    // event: deployment-global rows (no owner, no org), the caller's own
+    // rows, the caller's org's rows, and resource-scoped rows (owner/org
+    // don't gate those — access is decided below by
+    // `getChangeVisibilityForUser`'s access-aware branch, which can grant a
+    // non-owner sharee, so resource-scoped rows must still flow through that
+    // check regardless of who owns them). This lets Postgres/SQLite use the
+    // `sync_events_owner_version_idx` / `sync_events_org_version_idx` indexes
+    // instead of scanning every tenant's activity on every poll. The OR group
+    // is parenthesized so `version > ?` ANDs against the whole group, not
+    // just the first term. A caller with no org passes a null `orgId` bind
+    // param, which makes `org_id = ?` evaluate to no match for every row
+    // (including null-org rows) in both dialects — mirroring the
+    // `event.orgId && orgId` truthy check in `getChangeVisibilityForUser`.
     const result = await getDbExec().execute({
-      sql: `SELECT version, event_json FROM sync_events WHERE version > ? ORDER BY version ASC LIMIT ?`,
-      args: [since, DURABLE_READ_LIMIT + 1],
+      sql: `SELECT version, event_json FROM sync_events WHERE version > ?
+              AND (
+                (owner IS NULL AND org_id IS NULL)
+                OR owner = ?
+                OR org_id = ?
+                OR resource_type IS NOT NULL
+              )
+            ORDER BY version ASC LIMIT ?`,
+      args: [since, userEmail, orgId ?? null, DURABLE_READ_LIMIT + 1],
     });
     const events: ChangeEvent[] = [];
     let version = Math.max(_version, since);